external_auth: handle request.META values as str, not unicode