Fixes for issues 31 and 32

This merge request will fix issue #32 (closed) and parts of issue #31 (closed).

For issue #31 (closed), this will only change the comparison of the hashes to the user-supplied input by using hash_equals(). The download password are still hashed using MD5. Changing the hashing algorithm will eventually break downward compatibility if not done correctly.

But I think doing the comparison using hash_equals() will be a security benefit, since it prevents timing attacks attacks using Type Juggling. Changing the hashing algorithm for download passwords should be discussed.