Add Python 3 support for FacebookAuthorization.parse_signed_data

`json.loads` was expecting a string, but in python 3 `base64decode()`
return bytes and that is why it bugged. We fix this by making sure
the decoded payload data is in string and that `hmac.new()` is
provided with arguments in bytes. `open_facebook.utils.smart_str`
will do that job correctly in python 2 and 3.

We also use `hmac.compare_digest()` which is the preferred way to
compare those kinds of data to prevent timing analysis. If not
`hmac.compare_digest` is available (python 2.7.7+) then we just compare
logically.

Fixes #491.