[1.7.x] Fixed #23939 -- Moved session verification out of middleware.

https://code.djangoproject.com/ticket/23939
Everyone is affected by the deprecation of `AUTH_VERIFY_SESSION=False`, right? Because in a future Django version it'll be flipped to True by default, and that will affect everyone, even if they never used the middleware.

I think we need to distinguish between deprecating `SessionAuthenticationMiddleware`, which you've decided is OK to do on an accelerated schedule and mid-1.7.x (I'm still not sure I agree that that's justified, but let's set that aside for now), and the deprecation of `AUTH_VERIFY_SESSION=False`, which is effectively deprecating the entire concept of using unverified auth sessions. I think the latter is definitely not something that should be done in the middle of the 1.7.x series, since in 1.7 and 1.7.1 it was perfectly fine to use unverified sessions (that is, to not use `SessionAuthenticationMiddleware`). So I think this deprecation warning should not be present at all in 1.7.2 (that is, it should be warning-free to have `AUTH_VERIFY_SESSION=False`), but in 1.8 `AUTH_VERIFY_SESSION=False` should start its deprecation path (unrelated to use of the middleware). That also implies that session verification should be turned on by default in Django 2.0, not 1.9 -- I don't think there's really a justification for accelerated deprecation here.