switching to wsgi middleware
trying cookie based sessions. See if this helps with the csrf issues