patch breach for csrf tokens.

Adapted from https://github.com/rails/rails/pull/11729, with some fixes suggested by @tarcieri .

@tamird @strzalek @tarcieri PTAL