mozilla/django-session-csrf — pull request #16 by eressler (2014-03-25 00:59:07+00:00)
Title: Check for existence of request.user before calling is_authenticated()

There exists a race condition within the csrf middleware which causes AttributeError: 'WSGIRequest' object has no attribute 'user' when using Django's contrib authentication middleware.

The issue is request.user is created by the Authentication middleware so it doesn't exist yet if you have CSRF middleware listed above the Auth middleware in MIDDLEWARE_CLASSES.

But the CSRF middleware must be placed above the Auth middleware otherwise you get CSRF token errors when attempting to login to the admin.

Adding an extra check that the user attribute exists on the request before checking for is_authenticated() resolves this error.