invalid method signature, can't get my session key

Hello,

I've read a bunch of posts on the forum, still can't make my Python script get a session key. I've checked my parameters, I do not include the format, the signature is unicoded before doing the md5 checksum, and still can't use auth.getSession. Here's a code snippet:

def sign_call(params):
signature = unicode()
# signature is a md5hash of all parameters, sorted alphabetically
all_params = dict(params.items() + global_params.items())
# the signature must be calculated without the format parameter
del(all_params["format"])
for key in sorted(all_params.keys()):
signature += key + all_params[key]
signature += api_sec
sig = md5.new(unicode(signature))
assert(len(sig.hexdigest()) == 32)
print "Signature is " + signature #debug
return sig.hexdigest()

Printing out the signature for auth.getSession:
Signature is api_key<api_key>methodauth.getsessiontoken<token><secret>
And the final call:
Calling: http://ws.audioscrobbler.com/2.0/?api_key=<apikey>&format=json&method=auth.getSession&api_sig=<32char signature>

Can someone point out what I'm doing wrong?