SECURITY: API: Use constant-time comparison for watchlist token
Avoids a theoretical timing attack.
Bug: T94116 Change-Id: Ia4a2b13bd5d3cd256c6b2deada224148dc2888a6