__salt__['nacl.dec'](...) returns bytes on py36 when using the py renderer for a pillar

Description of Issue

I was retesting all my modules against py36 to make sure there were no issues.
So I upgrade my salt-master to a py36 version of 3000.1...

I noticed one of my py rendere pillar was broken, it deals with nacl encrypted passwords from a db and encodes them as nthash and shadow has for use by the states.

Setup

Here is a simplified version of what i do

#!py
import os
import hashlib
import binascii
nacl_key = '<cryptkeyhere>'

def nthash(password):
  return binascii.hexlify(
    hashlib.new(
      'md4',
      password.encode('utf-16le')
    ).digest()
  ).upper()

def run():
      # NOTE: salt-call --local nacl.enc data=password sk=nacl_key box_type=secretbox
      password_nacl = '<mynaclencryptedpassword>'
      password_clear = __salt__['nacl.dec'](
        data=user['password'],
        sk=nacl['db'],
        box_type='secretbox',
      )
      password_shadow = __salt__['shadow.gen_password'](password_clear, '<saltforshadow>', 'sha256')
      password_nthash = nthash(password_clear)


      return {
        'pwd_shadow': password_shadow,
        'pwd_nthash': password_nthash,
      }

# vim: tabstop=2 expandtab shiftwidth=2 softtabstop=2

Adding .decode("utf-8") behind the call to nacl.dec fixes the issue.

Steps to Reproduce Issue

Create a piller file py rendered pillar that calls nacl.dec and then tries to use the result expecting a stirng.

Versions Report

I had to roll back as I broke about 200 hosts when upgrading to py36... this was one issue... other issue needs more investigation... so can't provide the output.

Start with a py-rendered pillar that calls salt['nacl.dec'] under Python 3.6 and inspect the nacl.dec entry point. Reproduce the bytes-versus-string result, then verify the returned value works with the shown hashlib and shadow.gen_password calls.