Avoid CSRF token discovery by XORing token occurences in response body

Django CSRF tokens could potentially be discovered by a BREACH attack - an
attacker forcing a victim to request a page that contains both a CSRF token, and
the attacker's guess at a CSRF token, in its body. Since a successful guess
would result in duplicate substrings in the response, a server with compression
turned on would return a shorter result than an unsuccessful guess.

By XORing all occurences of the token in the body with a one-time pad, the value
in the body changes with every request, making it impossible to determine using
this method.