Authentication bypass via timing-variable token comparison

Timing discrepancy in RELATE 2024.1 and earlier allows remote attackers to recover valid sign-in tokens through response measurements. The check_sign_in_key() and EmailedTokenBackend.authenticate() paths compare attacker-supplied tokens with Python's timing-variable == operator instead of a constant-time comparison. No authentication or user interaction is required, but exploitation requires repeated network requests and precise timing measurements to recover a token byte by byte.