Defending Against Prompt Injection with a Few DefensiveTokens