'Ensure that the user\'s session hash hasn\'t changed. We check that
SessionAuthenticationMiddleware is enabled in order to match Django\'s
behavior.'

def _verify_session_auth(self, request):

    session_auth_class = 'django.contrib.auth.middleware.SessionAuthenticationMiddleware'
    session_auth_enabled = (session_auth_class in settings.MIDDLEWARE_CLASSES)
    auto_auth_enabled = settings.FEATURES.get('AUTOMATIC_AUTH_FOR_TESTING', False)
    if ((not auto_auth_enabled) and session_auth_enabled and hasattr(request.user, 'get_session_auth_hash')):
        session_hash = request.session.get(HASH_SESSION_KEY)
        if (not (session_hash and constant_time_compare(session_hash, request.user.get_session_auth_hash()))):
            request.session.flush()
            request.user = AnonymousUser()
