Add session auth middleware to settings.

Also tell isort to skip `settings.py` and `wsgi.py`.