Use a timing-safe equality check for passwords#133