add required MIDDLEWARE_CLASSES

Django 1.7 doesn't include session or auth middleware by default,
but we do need it.