fix issue in auth_tkt parsing with the cookie type being unicode

In webob the cookies are always unicode but the auth_tkt tests were
expecting them to be a native string. This didn't manifest itself until
we started using the ``hmac.compare_digest`` which fails if the types
are not the same.

Fixes #1477