mitigate timing attacks by taking no shortcuts

[cowens]

The eq operator stops comparing when it is obvious two strings aren't equal. An attacker can use this information to determine the right hash one character at a time. We can remove this information leak by using a string comparison function that uses no shortcut logic.