Fix #1892 - Stop session hijacking with UA check

Comes with a test!