XAPI: data-dependent compare function used for Pool Secret

ISSUE DESCRIPTION XAPI has a bearer token used to authenticate requests made between hosts in a pool, known as the Pool Secret. Comparison of this token is performed with a function which has data-dependent timing. An attacker may be able to use this as a timing oracle to infer the value of the...