fix: use timing-safe HMAC comparison in Nodeless callback controller

fix: use timing-safe HMAC comparison in Nodeless callback controller #24