Comment by TheLoneWolfling

And then your compiler will optimize it to this:

    int token_length = strlen(token);
    
    // Just get this out of the way now; no need to dawdle
    // (because the length of a token is generally known)
    if (token_length != strlen(input)) {
        return false;
    }
    
    // No need to worry about mismatched buffer lengths at this point
    for(int i=0; i<token_length; i++) {
        if (token[i] != input[i]) {
            return false;
        }
    }
    return true;

And all of a sudden the timing attack is back.

You cannot write a constant-time function in portable C / C++, and trying to do so is a fool's game.