WIP: Store credentials only in session if required

:warning: WIP DO NOT MERGE :warning:
> Call it hashEquals for clarity?


Ewww, I believe that hashEquals is a really bad name. I don't understand why new functions get called such a cryptic name. Other languages are going with something as "ConstantTimeCompare". 

This is named after the Symfony 2 Security Components and I'm kinda okay with it tbh.

> If this is only used mostly for crypto, how about just moving this to the Crypto class ?

Actually there are some other use-cases for this as well though there are not *that* many, but I'd like to keep this in this class as it makes things easier in case we want to add more such security functions in the future.