Shouldn't that second test be against `request.session[SESSION_HASH_KEY]`? Because now, the value must be equal to both the users pk and their session auth hash, or the session is flushed.