moz: be careful to only pass bytes to hmac

After that, re-encode the generated signature as Unicode, to unify
output between Python 2 and 3 (it's safe, because it's b64encoded
anyway).