GMS-2016-30: Non-Constant Time String Comparison

csrf-lite uses ===, a fail first string comparison, instead of a time constant string comparison. This enables an attacker being able to calculate minuscule differences in CSRF tokens, essentially enabling them to guess the token one character at a time Each check increases the variable tempCheck by one. If a malicious user is able to see what tempCheck is at each run (how long it takes to do a check), then they can see when it increases. This increase indicates that the character they just put in for csrfTokenCompare is the correct one.