sorry, I think in terms of Rails, in rails a session is a _site_sess cookie... i am not sure how it works in Django but what here is a post about it http://homakov.blogspot.com/2013/06/cookie-forcing-protectio...
https://github.com/mozilla/django-session-csrf seems ok, should be default
"i am not sure how it works in Django"
Perhaps you should do a little research before proclaiming things insecure?
bitbucket is vulnerable > django has a problem
if it's not enough:
some websites from http://www.djangosites.org/ are vulnerable > django has a problem
and yes, they clearly state it was made as a solution to cookie forcing:
>Your site is on a subdomain with other sites that are not under your control, so cookies could come from anywhere.
it should be default, for sure.
There's also https://github.com/mozilla/django-session-csrf, an alternate CSRF implementation by Mozilla that does use session-linked CSRF tokens. So if you insist on "tokens must be session-linked", you can use that instead.