It may make more sense to rename `masked_token` to `otp` or `random_pad`. `masked_token` is likely a better name for the XOR of the real CSRF token and our one-time pad.