CSRF token mask from breach-mitigation-rails gem

This merges in the code from the breach-mitigation-rails gem that masks authenticity tokens on each request by XORing them with a random set of bytes. The masking is used to make it impossible for an attacker to steal a CSRF token from an SSL session by using techniques like the BREACH attack.

The patch is pretty simple - I've copied over the [relevant code](https://github.com/meldium/breach-mitigation-rails/blob/master/lib/breach_mitigation/masking_secrets.rb) and updated the tests to pass, mostly by adjusting stubs and mocks. @NZKoz suggested that this would be a useful thing to have in Rails itself - we (and many others) have been using it in production for over a year with no issues.

The "length-hiding" code from the breach-mitigation-rails gem is not included here, as it is more complex, more brittle, and provides less protection against the attack - I don't think it's worth including.
shouldn't we use `ActiveSupport::SecurityUtils.secure_compare(token, real_csrf_token(session))` now?