add support for IP restrictions on sessions, to prevent hijacking. also allow authentication by email domain instead of specific email addresses, and allow ability to set the protocol of the auth domain