Don't generate a salt in verifyNoCredential
Don't generate a salt in verifyNoCredential

This fixes a timing vulnerability resulting from the nonnegligible
time taken to read from /dev/urandom.

ambiata/tinfoil,ambiata/tinfoil