Handle bogus values passed to `_xsrf`

Fix for tornadoweb/tornado#1096.