Handle bogus values passed to `_xsrf`

Fix for tornadoweb/tornado#1096.
Would it work to simply say `token = utf8(cookie)` in this case?