Update auth.py

Let's compare hashes in constant-time, for several reasons:
* Consistency with CSRF token validation
* Paranoia -- could an attacker side-channel our password hash? (Not unless the salt was known.)
Merge pull request #164 from sarciszewski/patch-1

Constant-time comparison of PBKDF2 hashes.