title: Inconsistance between `request.user` and `request.session` in Django
body: <p>I do understand that <code>login()</code> will attach <code>User</code> to <code>request.session</code> and <code>request.user</code> after <code>authenticate()</code> successfully validate credentials.</p>
  <p>I am wondering will there be any occasions where <code>request.user</code> becomes <code>anonymous user</code> and <code>request.session</code> still has <code>User</code> attached ?  I encountered this myself.</p>
  <p>If answer to above is yes, then when <code>request.user.is_authenticated == False</code>,
  should we</p>
  <ol>
  <li>flush the existing session, and prompt for login again to avoid someone use previously stored session. or</li>
  <li>we can directly attach <code>user</code> in <code>request.session</code> to <code>request.user</code> to make it logged_in user.</li>
  </ol>
  <p>thanks for your insights.</p>