fix: use timing-safe HMAC comparison in Nodeless callback controller …

fix: use timing-safe HMAC comparison in Nodeless callback controller … #43