If I'm not completely mistaken this will fail if the attacker requests a page where `csrfmiddlewaretoken` or `HTTP_X_CSRFTOKEN` is shorter than the `CSRF_KEY_LENGTH`.