I don't think we should move commonmiddleware this far down. Do we have a solid understanding of why this is breaking? Is request.user only missing when the user isn't logged in? Why not just set a reasonalbe default value? 'Anonymous' or something?