scjody/django-session-csrf — comment on commit 9885ee4ce7ab6f330f627ace1559a4a1828e8acd
File: session_csrf/__init__.py line 116
By scjody:

It has to be not(request.user.is_authenticated() or ANON_ALWAYS). We _don't_ want to do this for the ANON_ALWAYS case because it's already being done by the CSRF middleware.

Let me know which version you prefer.