Use hash_equals in User::matchEditToken