Use constant-time comparison for credentials