bmersereau closes a timing-attack loophole in Mike's download tokens

The helper guards download links by comparing secret tokens in a way that's supposed to take exactly the same amount of time regardless of whether the input matches. The problem: it was bailing out early when the lengths didn't line up, which technically let an attacker measuring response times tell a length mismatch apart from a content mismatch. That's the kind of side-channel that constant-time comparisons exist to prevent.

The rewrite always runs the comparison first against equal-length buffers, then folds the length check into the final result. bmersereau is honest that this isn't a live exploit - every token in the system is the same fixed length today - but the helper now actually honors its contract, and a small test suite is in place so future callers that pass variable-length inputs inherit a primitive that behaves the way its name promises.