mask csrf tokens with otp to prevent BREACH.
essentially copied from https://github.com/rails/rails/pull/11729.