Remove length requirement from v1 XSRF tokens
Turn short and hex XSRF tests into success tests
Don't raise when failing to hex decode XSRF v1
Catch `binascii.a2b_hex` errors on Python 3
Merge remote-tracking branch 'tictail/branch3.2'

Closes #1097
Add XSRF change to the release notes.
Set version number to 4.0b3.