Update auth.py

Constant time comparison. (I eyeballed `check_csrf()` this time)