Fixes timing attack when comparing CSRF tokens.