Changing "===" on secrets to hash_equals to protect from timing attacks.