When considering my own approach for this same problem, I specifically avoided using xor as when using it on printable characters, you wind up with lots of unprintables you probably don't want to put in your page.

Two approaches I considered were:
1. restricting tokens to hex ascii, and xoring their binary forms
2. using a "caeser cipher" approach, where each char is offset in the list of valid chars by the corresponding char in the random pad.
[modulo the list of chars, of course]