Handle bogus values passed to `_xsrf`

Fix for tornadoweb/tornado#1096.
You've got me, we're using Python 2 :cry: