Disallow hijacked sessions by checking the session's IP address against the client's IP
Take a more active approach in protecting against session spoofing: Kill off the session when we're confirmed to have a spoofed session