patch for breach. adapted from https://github.com/rails/rails/pull/11729/
better error handling for xor_byte_strings.
make sure otp is always same length as @master_csrf_token
fix test_enum_rjs_test to expect masked csrf_tokens.
Merge pull request #18 from square/nealharris/breach

patch breach for csrf tokens.