Add Python 3 support for FacebookAuthorization.parse_signed_data

`json.loads` was expecting a string, but in python 3 `base64decode()`
return bytes and that is why it bugged. We fix this by making sure
the decoded payload data is in string and that `hmac.new()` is
provided with arguments in bytes. `open_facebook.utils.smart_str`
will do that job correctly in python 2 and 3.

We also use `hmac.compare_digest()` which is the preferred way to compare
those kinds of data to prevent timing analysis. Read more about this on
python docs. Though this is only available from python 2.7.7.

Fixes #491.