Avoid CSRF token discovery via BREACH attack by masking with a random value

Patch for [ticket 20869 in trac](https://code.djangoproject.com/ticket/20869), using the same approach as the Rails patch mentioned in the first comment there.

Avoids CSRF token discovery via BREACH by XORing the token in the body with a value generated anew each request (actually, each time `get_token` is called) & storing said value alongside it.
This should be `assertTrue()` as `assert_()` is deprecated.