[merb-core] Fix potential timing attack on cookie sessions
[merb-core] Fix potential timing attack on cookie sessions

[#1298 state: resolved ]

This patch fixes a potential timing attack on the HMAC authentication
used to verify cookie session contents by ensuring a constant time
algorithm is used to compare the hashes.  For more information see:

http://codahale.com/a-lesson-in-timing-attacks/
merb/merb-core,merb/merb-core