Fix twp.csrf for modern selector and tiddlyweb

Cookie.py has a guard which checks the type of input against
the type of (""). That's very ambiguous in a Python 2&3 universe.
If the input is a python2 unicode for some reason, it blows up
trying to treat input as a dict.

This change forces the input to str().

The cause of this trouble is that modern selector and tiddlyweb
are trying to be pep 3333 (not just 333) compatible which means
that at the application level the value of headers are unicode
strings. In 333 this is ambiguious.
release 0.3