add secure equals method to prevent timing attacks