Constant time compare would be safer

[alokmenghrajani]

https://github.com/Kong/go-srp/blob/master/server.go#L55 should probably use crypto/subtle's ConstantTimeCompare. I'm guessing leaking timing is not exploitable in most contexts but you never know.