Use better random CSRF token.
Fixes #1634: Use masked CSRF tokens to prevent BREACH exploits