`isValidPayload` should use constant time comparison for secrets

[TomMD]

When comparing secrets one should use constant time comparison or a randomized comparison to avoid side channel attacks that can lead to compromise.