code: function compareMacs(key, mac1, mac2) {
    var hmac = forge.hmac.create();
  
    hmac.start('SHA1', key);
    hmac.update(mac1);
    mac1 = hmac.digest().getBytes();
  
    hmac.start(null, null);
    hmac.update(mac2);
    mac2 = hmac.digest().getBytes();
  
    return mac1 === mac2;
  }
docs: Safely compare two MACs. This function will compare two MACs in a way
  that protects against timing attacks.
  
  TODO: Expose elsewhere as a utility API.
  
  See: https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/february/double-hmac-verification/
  
  @param key the MAC key to use.
  @param mac1 as a binary-encoded string of bytes.
  @param mac2 as a binary-encoded string of bytes.
  
  @return true if the MACs are the same, false if not.