Explicitly set MIDDLEWARE_CLASSES for tests

Django 1.7 pared down the default MIDDLEWARE_CLASSES, so we have to
explicitly include auth and sessions.