fix: use timing-safe comparison for social account token validation

fix: use timing-safe comparison for social account token validation #893