Add the ip to the session key
Only append the ssid if using ie

No need to expose this information otherwise.  IE 9 and lower can not send cookies with CORs requests.
Use the same session name that JS was using