fix token issue - timing attack

Updates token comparisons to use a secure version instead of `==`

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/13617

See merge request !3062