I eliminated that vulnerability by caching and verifying both the source IP and username (trusted user identified as ip/username). So if a user is C/R authenticated from one IP, he is not from another.
My thoughts were that what used to be a single message exchange (getPerms/response) now has become (getParms/challenge/response/response/confirm/getPerms), which is expensive especially if a user is, say, iterating all files