[1.7.x] Fixed #23939 -- Moved session verification out of middleware.

https://code.djangoproject.com/ticket/23939
My thinking was people who are not using AuthenticationMiddleware aren't affected by session verification change and hence the deprecation. Do you think there are uses of `auth.get_request()` in third-party code that might be affected?