Prevent timing attack on CSRF, completing wonderful pr by @eutopian #48

Job	Run time
test (ubuntu-latest, 2.5)	30s
test (ubuntu-latest, 2.6)	29s
test (ubuntu-latest, 2.7)	27s
test (ubuntu-latest, 3.0)	20s
test (ubuntu-latest, 3.1)	15s
test (ubuntu-latest, 3.2)	11s
test (ubuntu-latest, head)	11s
test (ubuntu-latest, debug)	38s
test (ubuntu-latest, truffleruby)	43s
test (ubuntu-latest, truffleruby-head)	1m 7s
test (ubuntu-latest, jruby)	55s
test (ubuntu-latest, jruby-head)	58s
test (macos-latest, 2.5)	1m 0s
test (macos-latest, 2.6)	1m 10s
test (macos-latest, 2.7)	56s
test (macos-latest, 3.0)	26s
test (macos-latest, 3.1)	21s
test (macos-latest, 3.2)	28s
test (macos-latest, head)	25s
test (macos-latest, debug)	38s
test (macos-latest, truffleruby)	53s
test (macos-latest, truffleruby-head)	1m 20s
test (macos-latest, jruby)	1m 20s
test (macos-latest, jruby-head)	1m 5s
coveralls	4s
	16m 50s

Provide feedback