Prevent timing attack on CSRF, completing wonderful pr by @eutopian #45

Job	Run time
test (ubuntu-latest, 2.5)	35s
test (ubuntu-latest, 2.6)	36s
test (ubuntu-latest, 2.7)	31s
test (ubuntu-latest, 3.0)	16s
test (ubuntu-latest, 3.1)	12s
test (ubuntu-latest, 3.2)	15s
test (ubuntu-latest, head)	16s
test (ubuntu-latest, debug)	43s
test (ubuntu-latest, truffleruby)	46s
test (ubuntu-latest, truffleruby-head)	54s
test (ubuntu-latest, jruby)	1m 8s
test (ubuntu-latest, jruby-head)	50s
test (macos-latest, 2.5)	1m 20s
test (macos-latest, 2.6)	1m 12s
test (macos-latest, 2.7)	1m 3s
test (macos-latest, 3.0)	23s
test (macos-latest, 3.1)	1m 11s
test (macos-latest, 3.2)	38s
test (macos-latest, head)	25s
test (macos-latest, debug)	58s
test (macos-latest, truffleruby)	1m 30s
test (macos-latest, truffleruby-head)	1m 18s
test (macos-latest, jruby)	1m 1s
test (macos-latest, jruby-head)	1m 18s
coveralls	0s
	19m 19s

Provide feedback