Replace CSRF randomizing with generalized masking