Use constant time comparison function

[tiran]

social.backend.facebook compares HMAC signatures with '=='. That's insecure and may leak information. You should use a function like http://docs.python.org/3/library/hmac.html#hmac.compare_digest. Django has a Python implementation of the function, too.

[omab]

Fixed, thanks for the report.