httpauth.py, cookies.fhtml: Randomize CSRF token to prevent BREACH.

httpauth.py, cookies.fhtml: Randomize CSRF token to prevent BREACH.

The use of `gzip' compression by servers, combined with the possibility
of inserting request parameters in responses can leak information from
responses, notably the CSRF token.  We can defend this by splitting it
into two XOR pieces and combining them together again in the server.