Prevent timing attacks

[jonduarte]

A simple change on how username and password are compared to avoid timing attacks.