Adapt to xsrf_cookies depreciation from tornado

[piraz]

With tornado 6.3 the xsfr_cookies will be depreciated. Let's keep an eye on:

• Tornado 6.3 tornadoweb/tornado#3217
• XSRF cookie expiration issues tornadoweb/tornado#865
• Allow resetting the XSRF cookie/token tornadoweb/tornado#3026
• support samesite xsrf cookie tornadoweb/tornado#2573

[bdarnell]

FYI I've reversed my decision to deprecate xsrf_cookies at this time; see tornadoweb/tornado#3226 (comment) for details. SameSite cookies are not a sufficient replacement for xsrf_cookies (although the sec-fetch-site header might be once it is supported in all browsers).

[piraz]

I'm aware about that @bdarnell, thank you for the heads up anyways.