Handle bogus values passed to `_xsrf`

Fix for tornadoweb/tornado#1096.
This fails on Python 3 (see the travis logs) - it raises binascii.Error instead of TypeError.