replace constant_time_compare with hmac.compare_digest

[jllopezpino]

Hi Mike,

My commit should fix the problem that I reported on #57.
It would be great if you can review it and release a new version to pypi because latest itsdangerous version on pypi breaks this package.

Thanks!

[invisiblek]

you need to keep the import of Signer

[mikeboers]

Hi @jllopezpino,

Thanks for your patience.

I believe @invisiblek is correct, and it won't work as-is.

I think we ought to:

• Use hmac.compare_digest as you did
• Use hmac to do the signing for simplicity (ideally allowing use of the same settings that itsdangerous did so that signatures remain compatible
• Remove all of the nonsense required for Py2 to work; I'm fine with only supporting >=3.3.

[jllopezpino]

• Remove all of the nonsense required for Py2 to work; I'm fine with only supporting >=3.3.

I would go that way. But you are the maintainer here : )

[jllopezpino]

#60 already covers this