Seems like you could also move the IP binding code here and maybe we could remove some of the convoluted session validation checks