RestrictedSessionsMiddleware causes constant logouts on Heroku, sometimes immediately after logging in. Disabling the middleware fixed the issue.

Note: the issue does not occur in local development, only in production.

My settings.py:
RESTRICTEDSESSIONS_AUTHED_ONLY = True

When running the Middleware on Django 1.11 I got the following DepricationWarning

restrictedsessions/middleware.py:33: RemovedInDjango20Warning: Using user.is_authenticated() and user.is_anonymous() as a method is deprecated. Remove the parentheses to use it as an attribute.
  if not user or not hasattr(user, 'is_authenticated') or not user.is_authenticated():

Django restricted sessions still uses the force_text but has been removed in django 4.0

Release notes Django 4.0

https://docs.djangoproject.com/en/4.0/releases/4.0/#features-removed-in-4-0

django.utils.encoding.force_text() and smart_text() are removed.

We still want to check the user agent if the IP address is an empty value.

It's possible for HTTP_X_FORWARDED_FOR to receive multiple IP addresses separated by a comma+space. This currently throws an exception when received and logs the user out.

The flow on our site is to return the user to the login if the user agent clears the session. This PR adds support for a setting to redirect to a named view instead of returning an HTTP status code. In PR: #3