SECURITY: API: Use constant-time comparison for watchlist token