Attempt to mitigate timing attacks

Comparing client input to secret values must be done in a secure, time-independent way.

See here: https://docs.python.org/2/library/hmac.html#hmac.compare_digest