Avoid CSRF token discovery by XORing token occurences in response body

Django CSRF tokens could be discovered by an attacker forcing a victim to
request a page that contains both a CSRF token, and the attacker's guess at a
CSRF token, in its body. Since a successful guess would result in duplicate
substrings in the response, a server with compression turned on would return a
shorter result than an unsuccessful guess.

By XORing all occurences of the token in the body with a one-time pad, the value
in the body changes with every request, making it impossible to determine using
this method.