diff -r 2dae5bf5ea68 -r b1e933b0e850 web/webconfig.py
--- a/web/webconfig.py	Mon Sep 09 12:43:25 2013 +0200
+++ b/web/webconfig.py	Mon Dec 09 16:13:10 2013 +0100
@@ -135,7 +135,7 @@
         ('https-deny-anonymous',
          {'type': 'yn',
           'default': False,
-          'help': 'Prevent anonymous user to browse thought https version of '
+          'help': 'Prevent anonymous user to browse through https version of '
                   'the site (https-url). Login form will then be displayed '
                   'until logged',
           'group': 'web',
@@ -296,6 +296,9 @@
 
     def sign_text(self, text):
         """sign some text for later checking"""
+        # hmac.new expect bytes
+        if isinstance(text, unicode):
+            text = text.encode('utf-8')
         # replace \r\n so we do not depend on whether a browser "reencode"
         # original message using \r\n or not
         return hmac.new(self._instance_salt,
@@ -305,7 +308,6 @@
         """check the text signature is equal to the given signature"""
         return self.sign_text(text) == signature
 
-
     def locate_resource(self, rid):
         """return the (directory, filename) where the given resource
         may be found