[server] fix unittest_security for py3k - use source.binary_to_str instead of str(), helps when the backend returns memoryviews - fixup str vs bytes

<div id="ajaxroot">
  <h1>Hello</h1>
</div>