TokenAuthenticatable provides comparison method

Avoids attempting save on comparison, as that could potentially reveal
that a resource exists.

Uses secure comparison incase this is reused somewhere sensitive.

app/models/concerns/token_authenticatable.rb

@@ -53,6 +53,11 @@ module TokenAuthenticatable
       define_method("reset_#{token_field}!") do
         strategy.reset_token!(self)
       end
+
+      define_method("#{token_field}_matches?") do |other_token|
+        token = read_attribute(token_field)
+        token.present? && ActiveSupport::SecurityUtils.variable_size_secure_compare(other_token, token)
+      end
     end
   end
 end