Perf gain in masking
From @rdlowrey via IRC:

Using str_pad instead of looping over the payload to mask/de-mask should yield a performance gain:

``` php
$payload = $payload ^ str_pad('', $length, $mask, STR_PAD_RIGHT);
```
