I get that it's just supposed to be illustrative, but the "verify_request()" function presented is cryptographically unsound because the == comparison is not constant-time.