Forms: the CSRF token is protected against BREACH attack

Here's a nice demonstration of BREACH attack: http://resources.infosecinstitute.com/the-breach-attack/

~~The CSRF token is split into two parts (A and B). The part A is be always a new random string of the same length as the token. The part B is a XOR of the part A and the token. (We can easily reconstruct the token as a XOR of the parts A and B.) So the attacker cannot detect the CSRF token, because the parts A and B will be different on each request.~~ I simplified the [algorithm](https://github.com/nette/nette/pull/1378/files#diff-d6f3e4faa4c4aa64f9259cf7cbe0140fR58).