Verify api keys in constant-time

This is just a quick fix. The verification code needs further work and
breaking changes of the config schema.