Clarified that constant_time_compare doesn't protect string lengths.

    Returns True if the two strings are equal, False otherwise.

    The time taken is independent of the number of characters that match.

    For the sake of simplicity, this function executes in constant time only

    when the two strings have the same length. It short-circuits when they

    have different lengths. Since Django only uses it to compare hashes of

    known expected length, this is acceptable.

    """

    if len(val1) != len(val2):

        return False