Add MIDDLEWARE_CLASSES

Otherwise it defaults to include CSRF, which we don't want.

This was not caught by tests because the django client includes CSRF.