hash and constant time equals to prevent timing attacks

[leishman]

This change should reasonably prevent timing attacks against http auth in "/metrics" endpoint. The current implementation does nothing to prevent timing attacks against the equality check in valid_basic_credentials?.