avoid timing attacks using passlib consteq instead of ==