Avoid CSRF token discovery via BREACH attack by masking with a random value

Patch for [ticket 20869 in trac](https://code.djangoproject.com/ticket/20869), using the same approach as the Rails patch mentioned in the first comment there.

Avoids CSRF token discovery via BREACH by XORing the token in the body with a value generated anew each request (actually, each time `get_token` is called) & storing said value alongside it.
This same set of chars is defined in django.utils.crypto as the default for "allowed_chars" for the get_random_string function.

Should we consider making this a more accessible constant?