Invalid XSRF cookie value throws TypeError

[tiwilliam]

When running Tornado 3.2.2 and getting bogus data sent in XSRF cookies, we end up with following exception. _xsrf is set to foo in following trace.

Stacktrace (most recent call last):
  File "tornado/web.py", line 1338, in _execute
    self.check_xsrf_cookie()
  File "tornado/web.py", line 1184, in check_xsrf_cookie
    if not _time_independent_equals(utf8(token), utf8(expected_token)):
  File "tornado/web.py", line 2759, in _time_independent_equals
    if len(a) != len(b):
TypeError: object of type 'NoneType' has no len()