Attempt to mitigate timing attacks

Comparing client input to secret values should be done in a secure, time-independent way.

See here: https://docs.python.org/2/library/hmac.html#hmac.compare_digest
A slightly less bad timing vulnerability exists here because python will shortcut as soon as any of these terms evaluate to False.  This could allow someone to determine if the client_id is valid or not based on timings.