Do not access the session unless needed

[codingjoe]

If the session wasn't accessed we do not need to modify the response.
Session get accessed lazily if someone accesses request.user or
request.session. In those cases Django will add cookie to the
Vary-On HTTP header. This will prevent browsers from caching the
results.

Furthermore, accessing the user when not needed will cause unwanted
IO on request, that don't need authentication or vary content based
on users.

We use the same behavior Django implements in the authentication
middlware, where a user is a lazy object and will only be fetched
if needed. We simply overwrite the user and add another setup
hook.

[codecov-commenter]

Codecov Report

Merging #509 (e697759) into master (bc8be46) will increase coverage by 0.02%.
The diff coverage is 100.00%.

@@            Coverage Diff             @@
##           master     #509      +/-   ##
==========================================
+ Coverage   99.24%   99.27%   +0.02%     
==========================================
  Files           7        7              
  Lines         133      138       +5     
==========================================
+ Hits          132      137       +5     
  Misses          1        1              

Impacted Files	Coverage Δ
hijack/middleware.py	100.00% <100.00%> (ø)

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.