Python's built-in compare_digest is crappy when strings are of different
lengths. My secure_compare handles them slightly better, but there's still a
slight problem with cache timing (see comments).