Secure compare password
Secure API keys

Reduce possibility of timing attack and HMAC keys in the database
Don't use default secret in production
Prefix env vars with HEX_
Merge pull request #37 from hexpm/emj-secure-keys

Secure API keys