'The XSRF-prevention token for the current user/session.
To prevent cross-site request forgery, we set an \'_xsrf\' cookie
and include the same \'_xsrf\' value as an argument with all POST
requests. If the two do not match, we reject the form submission
as a potential forgery.
See http://en.wikipedia.org/wiki/Cross-site_request_forgery
.. versionchanged:: 3.2.2
The xsrf token will now be have a random mask applied in every
request, which makes it safe to include the token in pages
that are compressed.  See http://breachattack.com for more
information on the issue fixed by this change.  Old (version 1)
cookies will be converted to version 2 when this method is called
unless the ``xsrf_cookie_version`` `Application` setting is
set to 1.'

@property
def xsrf_token(self):

    if (not hasattr(self, '_xsrf_token')):
        (version, token, timestamp) = self._get_raw_xsrf_token()
        output_version = self.settings.get('xsrf_cookie_version', 2)
        if (output_version == 1):
            self._xsrf_token = binascii.b2a_hex(token)
        elif (output_version == 2):
            mask = os.urandom(4)
            self._xsrf_token = '|'.join(['2', binascii.b2a_hex(mask), binascii.b2a_hex(_websocket_mask(mask, token)), utf8(str(int(timestamp)))])
        else:
            raise ValueError('unknown    xsrf    cookie    version    %d', output_version)
        if (version is None):
            expires_days = (30 if self.current_user else None)
            self.set_cookie('_xsrf', self._xsrf_token, expires_days=expires_days)
    return self._xsrf_token
