BREACH mitigation

XORs a nonce into the CSRF field.