Is there a risk using REMOTE_ADDR here? Theoretically 2 people could log in at the exact same time from the same IP address and this wouldn't be unique.