constant time compare for client secret verification will be kept Signed-off-by: Rui Yang <ruiya@vmware.com>