- Use secrets.compare_digest() for token comparison instead of == to
prevent timing-based attacks that could leak token information
- Fix rotate_session_auth_token() to call the correct method
rotate_session_token() instead of non-existent rotate_session_auth_token()
