Handle bogus values passed to `_xsrf`

Fix for tornadoweb/tornado#1096.
Both of these are failure tests, not success tests (at least with the behavior in this commit; I'm thinking that it would be better if we allowed short and non-hex tokens instead of just transforming uncaught TypeErrors and 500s into 400s).