Fix a timing attack

The HMAC validation code early-exits on mismatch, which would allow an attacker to reconstruct the hash one byte at a time.  Granted, assuming this is over SSL and SHA1 hasn't been broken there are still a number of obstacles that must be overcome, but better safe than sorry.