Attempt to mitigate timing attacks

Comparing client input to secret values should be done in a secure, time-independent way.

See here: https://docs.python.org/2/library/hmac.html#hmac.compare_digest