Ok, I can reproduce the issue.
Actually, in the "long(hexlify(urandom(4)), 16)" expression, the problem was
with "urandom", not with "hexlify" as I wrongly assumed!

With Python 2.3.5:
>>> from mercurial import hg
>>> from os import urandom
>>> urandom(1)
Traceback (most recent call last):
  File "<stdin>", line 1, in ?
  File "C:\ProgramFiles\Python235\Lib\site-packages\mercurial\demandimport.py",
line 70, in __call__
    raise TypeError("'unloaded module' object is not callable")
TypeError: 'unloaded module' object is not callable


This comes from the fact that in Python 2.3.5, urandom is not defined, and from
the normal import, one should get:

>>> from os import urandom
Traceback (most recent call last):
  File "<stdin>", line 1, in ?
ImportError: cannot import name urandom

The original code that breaks (in AccountManager's plugin for Trac) is the
following:

# os.urandom was added in Python 2.4
# try to fall back on reading from /dev/urandom on older Python versions
try:
    from os import urandom
except ImportError:
    from random import randrange
    def urandom(n):
        return ''.join([chr(randrange(256)) for _ in xrange(n)])


With Python 2.3.5 and demandimport.enabled(), the ImportError is not raised, so
the compatibility function urandom is not installed.