Capability token verification

Verify a capability token of the form 'resource|action|expiry|sig' where sig is the lowercase hex HMAC-SHA256, keyed by a server secret, over the exact byte string 'resource|action|expiry' (the part before the final '|'). Given the secret (str), the token (str), the requested resource, the requested action, and the current time 'now' (int), return True only if: the token has exactly 4 pipe-delimited fields, the HMAC matches under constant-time comparison, the token's resource and action equal the requested ones, and int(expiry) > now. Return False on any malformed field or mismatch.