title: Django Login App Returning 403 Forbidden, CSRF Issues
body: <p>I'm using this <a href="http://solutoire.com/2009/02/26/django-series-1-a-custom-login-page/" rel="nofollow">tutorial</a> to try out creating a django login application (super simple stuff...)</p>
  
  <p>This is the code I end up with in my template (<code>index.html</code>)</p>
  
  <pre><code>&lt;div id="login-box"&gt;
              {{ state }}
              &lt;form class="login-widgets" action="/login/" method="post"&gt;
                  {% if next %}
                  &lt;input class="login-widgets-text" type="hidden" name="next" value="{{ next }}" /&gt;
                  {% endif %}
                  Username :
                  &lt;input class="login-widgets-text" type="text" name="username" value="{{ username}}" /&gt;&lt;br /&gt;
                  Password :
                  &lt;input type="password" name="password" value="" /&gt;&lt;br /&gt;
                  &lt;input class="login-button" type="submit" value="Log In" /&gt;
              &lt;/form&gt;
              &lt;!--&lt;div class="login-widgets"&gt;
                  &lt;p&gt;Username : ___________&lt;/p&gt;
                  &lt;p&gt;Password : ___________&lt;/p&gt;
              &lt;/div&gt;--&gt;
        &lt;/div&gt;
  </code></pre>
  
  <p>And this is what the tutorial told me to add to my app <code>views.py</code> page:</p>
  
  <pre><code>def login_user(request):
      state = "Please log in below..."
      username = password = ''
      if request.POST:
          username = request.POST.get('username')
          password = request.POST.get('password')
  
          user = authenticate(username=username, password=password)
          if user is not None:
              if user.is_active:
                  login(request, user)
                  state = "You're successfully logged in!"
              else:
                  state = "Your account is not active, please contact the site admin."
          else:
              state = "Your username and/or password were incorrect."
  
      return render_to_response('index.html',{'state':state, 'username': username})
  </code></pre>
  
  <p>I set up my test database exactly as it was described in the tutorial and on the django docs, but still my login keeps getting this error in the browser:</p>
  
  <pre><code>Forbidden (403)
  CSRF verification failed. Request aborted.
  </code></pre>
  
  <p>I don't understand what it means by CSRF verification - in my <code>settings.py</code> I have set up the MIDDLEWARE_CLASSES with the following:</p>
  
  <blockquote>
    <p>MIDDLEWARE_CLASSES = (
        'django.middleware.common.CommonMiddleware',
        'django.contrib.sessions.middleware.SessionMiddleware',
        'django.middleware.csrf.CsrfViewMiddleware',
        'django.contrib.auth.middleware.AuthenticationMiddleware',
        'django.contrib.messages.middleware.MessageMiddleware',
        # Uncomment the next line for simple clickjacking protection:
        # 'django.middleware.clickjacking.XFrameOptionsMiddleware', )</p>
  </blockquote>
  
  <p>But I'm not sure how to verify the CSRF and authenticate login. As far as I know, the database super user and the code above looks correct, except I don't know how to add CSRF verification. 
  Thank you so much for your help!</p>