Interesting that the session middleware was the culprit. BTW, why did you put it at the end of your middleware list?
The default order is: "django.middleware.sessions.SessionMiddleware", "django.middleware.common.CommonMiddleware", "django.middleware.doc.XViewMiddleware", (see http://www.djangoproject.com/documentation/settings/#middleware-classes). Thanks, Eugene