check remote addr against session fixation attack