Force `session.sid` to `str`

It comes back from the cookie as a unicode instance, which
broke GTW.RST.Signed_Token.Anti_CSRF after the session `sid` was
just renewed.