in FacebookCanvasMiddleware you do this:
raw_fbrequest = request.GET.get('signed_request', None)
...but Canvas apps now receive the signed_request via POST not GET.
Facebook docs now suggest using Django's REQUEST attribute to accept either way:
http://developers.facebook.com/docs/canvas/post/