[1.7.x] Fixed #23939 -- Moved session verification out of middleware.

https://code.djangoproject.com/ticket/23939
Why is the middleware check here? It seems to me that `AUTH_VERIFY_SESSION = False` should be deprecated regardless of whether you have the middleware in your settings or not.