Make Gitlab token verification constant time

[neiser]

This prevents leakage of token information using timing attacks. A simple string comparison does not suffice here.

It's also good practice to hash first to prevent leakage of the length of the secret, as subtle.ConstantTimeCompare has the undesired behavior of returning early if the length of the two given byte slices does not match. A hash function always generates a byte slice of constant length though.

[coveralls]

Coverage: 88.244% (+0.04%) from 88.208% when pulling 5f7b060 on neiser:prevent-timing-attacks into 4f72f9c on go-playground:master.