Avoid short-circuiting to circumvent username and password timing attacks

[jennydaman]

pfcon/pfcon/resources.py

Line 203 in 410cd5a

return user == self.pfcon_user and password == self.pfcon_password

ref: https://github.com/Alex-Werner/http-server-with-auth/blob/2a882d1e093cfc4bec5cb740e0a3a4d4965e9824/lib/http-server-with-auth.js#L73