make the lib depend on bytes; now compliant with -safe-string

What the title says. We should be future-proof.