Improve CSRF token masking

Instead of encrypting tokens, they are now masked by XORing them with
a pad[1]. Encrypting tokens is pointless when the value sent to the
client includes the key along with the encrypted token. The point anyway
is just to vary the token text on each request to make it harder to
guess in certain contexts (e.g., HTTPS with compression).

The other reason for doing this is so that PyCrypto isn't required to
mask tokens, and because of that, tokens are now *always* masked (since
I can't see any point in not masking them).

[1] Ideally, this would be a one time pad, but it's actually not because
the user can hit the back button and resubmit a form. We could disallow
this, but it would be somewhat user-unfriendly.
Return request.csrf_tag as a Markup object

This indicates that it shouldn't be escaped so that it's not necessary
to explicitly indicate this to templating engines.

E.g., in Mako, it's now possible to say `${request.csrf_tag}` instead of
`${request.csrf_tag | n}`.

I'm not sure if this works with other templating engines, but it
shouldn't cause issues where it's not supported (since Markup is just
a subclass of str).