Coerce tokens to strings before decoding

In 551b4ac13e31b3861c1cd2d3aa3a76f5c1330799, I broke the tests by
upgrading to Flask 0.9, which returns unicode headers rather than plain
ol' Python strings. This commit fixes that breakage by ensuring that
anything passed to `auth.decode_token(...)` in the token field is
coerced to a string before decoding.