Prevent session ID theft

Store IP and User-Agent while creating session and check them every request. This should prevent using stolen session IDs.