Fixed #22477 -- Removed contrib middleware from the global settings defaults.

Also added a compatibility check for changed middleware defaults.

Forwardport of d94de802d3 from stable/1.7.x

docs/releases/1.7.txt

@@ -68,6 +68,8 @@ but a few of the key features are:
   inside ``TransactionTestCase`` :ref:`unless specifically requested
   <test-case-serialized-rollback>`.
 
+.. _app-loading-refactor-17-release-note:
+
 App-loading refactor
 ~~~~~~~~~~~~~~~~~~~~
 
@@ -1114,6 +1116,27 @@ in a test class which is a subclass of
 :class:`~django.test.TransactionTestCase` rather than
 :class:`~django.test.TestCase`.
 
+Contrib middleware removed from default :setting:`MIDDLEWARE_CLASSES`
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The :ref:`app-loading refactor <app-loading-refactor-17-release-note>`
+deprecated using models from apps which are not part of the
+:setting:`INSTALLED_APPS` setting. This exposed an incompatibility between
+the default :setting:`INSTALLED_APPS` and :setting:`MIDDLEWARE_CLASSES` in the
+global defaults (``django.conf.global_settings``). To bring these settings in
+sync and prevent deprecation warnings when doing things like testing reusable
+apps with minimal settings,
+:class:`~django.contrib.sessions.middleware.SessionMiddleware`,
+:class:`~django.contrib.auth.middleware.AuthenticationMiddleware`, and
+:class:`~django.contrib.messages.middleware.MessageMiddleware` were removed
+from the defaults. These classes will still be included in the default settings
+generated by :djadmin:`startproject`. Most projects will not be affected by
+this change but if you were not previously declaring the
+:setting:`MIDDLEWARE_CLASSES` in your project settings and relying on the
+global default you should ensure that the new defaults are in line with your
+project's needs. You should also check for any code that accesses
+``django.conf.global_settings.MIDDLEWARE_CLASSES`` directly.
+
 Miscellaneous
 ~~~~~~~~~~~~~