  from django.utils.crypto import constant_time_compare, get_random_string
  from django.utils.deprecation import MiddlewareMixin
  from django.utils.encoding import force_text
  from django.utils.http import is_same_domain
  from django.utils.six.moves.urllib.parse import urlparse
  
  
  logger = logging.getLogger('django.request')
  
 
</s> remove import json

 </s> add  </s> remove from django.middleware.csrf import CsrfViewMiddleware, get_token
 </s> add from django.middleware.csrf import (
    CsrfViewMiddleware, _compare_salted_tokens as equivalent_tokens, get_token,
)
from django.utils.six.moves import zip
  from django.utils.crypto import constant_time_compare, get_random_string
  from django.utils.deprecation import MiddlewareMixin
  from django.utils.encoding import force_text
  from django.utils.http import is_same_domain
from django.utils.six.moves import zip
  from django.utils.six.moves.urllib.parse import urlparse
  
  
  logger = logging.getLogger('django.request')
  
keep keep keep add keep keep keep keep keep
 Fixed #20869 -- made CSRF tokens change every request by salt-encrypting them

Note that the cookie is not changed every request, just the token retrieved
by the `get_token()` method (used also by the `{% csrf_token %}` tag).

While at it, made token validation strict: Where, before, any length was
accepted and non-ASCII chars were ignored, we now treat anything other than
`[A-Za-z0-9]{64}` as invalid (except for 32-char tokens, which, for
backwards-compatibility, are accepted and replaced by 64-char ones).

Thanks Trac user patrys for reporting, github user adambrenecki
for initial patch, Tim Graham for help, and Curtis Maloney,
Collin Anderson, Florian Apolloner, Markus Holtermann & Jon Dufresne
for reviews. 
django/middleware/csrf.py