[Django]-Tons of false positives from Django's CSRF middleware?

CSRF protection in Django is based on hidden field plus properly working session. If you use subdomains to differentiate these two sites, check if your settings.SESSION_COOKIE_DOMAIN is set properly to handle your case.