Thanks to Tim Graham for the review.
The reverse() added in 50aa1a790ca66c2a93e0a52e00c53375b269ff49 crashed on a custom user model.
This allows using a UUIDField primary key along with the JSON session serializer. Thanks to Trac alias jamesbeith for the report and Simon Charette for the initial patch.