Prevent session hijacking by checking useragent (fixes #1892)