I've recently pushed a Django app live. We built the app in a staging subdomain on the server. When I went live, I copied the files of the staging subdomain to the main site, created a staging database and pointed the old staging site at the new staging database (leaving the new live site pointed at the original database). This is on mod_python under Apache.
I've created unique SESSION_COOKIE_NAME settings for both sites and I've set SESSION_COOKIE_DOMAIN to ".sitename.com" for the live site and None for the staging site.
The problem we're seeing is users in the live admin are making edits that (it appears) are being saved to the staging site. Users are also being logged out of the admin site "randomly" during requests.
Is there something I'm clearly doing wrong here? Should SESSION_COOKIE_DOMAIN be "www.sitename.com" to restrict it since the subdomain is at "staging.sitename.com"? Did I leave behind old session info in the now-live database (I ran ./manage.py clean and deleted all the sessions from the live database before this issue cropped up)?
Thanks