session cookie for IP-based cookie auth