use hmac.compare_digest if available
Merge pull request #1457 from Pylons/feature.string-timing-attacks

use hmac.compare_digest if available