Apply a one-time pad to CSRF token occurences in response body to avoid BREACH

Django CSRF tokens could potentially be discovered by a BREACH attack - an
attacker forcing a victim to request a page that contains both a CSRF token, and
the attacker's guess at a CSRF token, in its body. Since a successful guess
would result in duplicate substrings in the response, a server with compression
turned on would return a shorter result in this case than an unsuccessful guess.

By one-time padding all occurences of the token in the body with a one-time pad,
the value in the body changes with every request, making it impossible to
determine using this method.