Change cookie signature comparison to resist timing attacks (based on code suggested by Robin Green and Austin Seipp)

fun other () = return <xml>Hi!</xml>

fun main () = return <xml>{[Basis.url (main ())]}, {[url (other ())]}</xml>