这是Django版本的问题，1.9之前，中间件的key为MIDDLEWARE_CLASSES, 1.9之后，为MIDDLEWARE。所以在开发环境和其他环境的版本不一致时，要特别小心，会有坑。
将settings里的MIDDLEWARE_CLASSES默认配置顺序改成如下
MIDDLEWARE_CLASSES = [ 'django.middleware.security.SecurityMiddleware', 'django.middleware.common.CommonMiddleware', 'django.contrib.sessions.middleware.SessionMiddleware', 'django.middleware.csrf.CsrfViewMiddleware', 'django.contrib.auth.middleware.SessionAuthenticationMiddleware', 'django.contrib.auth.middleware.AuthenticationMiddleware', 'django.contrib.messages.middleware.MessageMiddleware', 'django.middleware.clickjacking.XFrameOptionsMiddleware', ]
就解决了问题