Update auth.py

Let's compare hashes in constant-time, for several reasons:
* Consistency with CSRF token validation
* Paranoia -- could an attacker side-channel our password hash? (Not unless the salt was known.)
* Establish a good habit now, as other developers will probably reference EFF projects for examples and inspiration