[hansonkd]

You don't need to store CSRF in sessions. Django doesn't by default.

CSRF token can be entirely separate from sessions.

[smagin]

not even you don't need to, you shouldn't. Sessions shouldn't be accessible to js at all