Make AX sync API work in real life
Make AX sync API work in real life

* Python<2.7.7 does not provide hmac.compare_digest. Use
  django.utils.crypto.constant_time_compare instead.
* Django expects a CSRF token for POST request. Tell it there is none,
  because data gets pushed to the API through a direct POST request.

Polytechnique-org/xorgauth,Polytechnique-org/xorgauth