Use hash_equals (introduced in 5.6) to check the token

PHP 5.6 introduce function to compare two strings which use the same time regardless the result.
http://php.net/manual/fr/function.hash-equals.php