Impacted versions: 11.0

Steps to reproduce: Create User 'abc' --> login with 'abc' on new Window --> Delete User 'abc' --> Refresh or access `http://localhost:8069/` or  `http://localhost:8069/web/database/manager` on window where user 'abc' was logged in.

Current behavior: Forbidden
You don't have the permission to access the requested resource. It is either read-protected or not readable by the server.
```
  File "/home/swapnesh/Workspace/11/odoo/addons/base/ir/ir_http.py", line 108, in _authenticate
    request.session.check_security()
  File "/home/swapnesh/Workspace/11/odoo/http.py", line 1067, in check_security
    if not security.check_session(self, env):
  File "/home/swapnesh/Workspace/11/odoo/service/security.py", line 21, in check_session
    if odoo.tools.misc.consteq(self._compute_session_token(session.sid), session.session_token):
  File "/usr/local/lib/python3.6/dist-packages/passlib/utils/__init__.py", line 295, in consteq
    raise TypeError("inputs must be both unicode or both bytes")
TypeError: inputs must be both unicode or both bytes
```

Expected behavior: `http://localhost:8069/web/database/manager` should open.

Video/Screenshot link (optional):


import odoo
import odoo.exceptions
def login(db, login, password):
    res_users = odoo.registry(db)['res.users']
    return res_users._login(db, login, password)
def check(db, uid, passwd):
    res_users = odoo.registry(db)['res.users']
    return res_users.check(db, uid, passwd)
def compute_session_token(session, env):
    self = env['res.users'].browse(session.uid)
    return self._compute_session_token(session.sid)
def check_session(session, env):
    self = env['res.users'].browse(session.uid)
    if odoo.tools.misc.consteq(self._compute_session_token(session.sid), session.session_token):
        return True
    self._invalidate_session_cache()
    return False