Use slow equals to avoid timing attacks