Advanced session hijacking mitigation

utilizing ssl_session_id (when mod_ssl is enabled) and ip/user-agent
when using raw http connections an additional check is done to ensure
that cooked are not copied between systems thus preventing session
hijacking

If a user with a valid CAS session attempts to copy another user's
cookie the existing CAS session will simply reestablish and the stolen
cookie will be invalidated.
While this could potentially create a denial of service; the risk is
limited to non-https connections.

In addition the isSSL function now utilizes the mod_ssl optional function ssl_is_https 
Given the previous remark about IP address causing problems with NAT sources, we're left with a simple hash of the user agent.  This is something that can also be stolen via XSS (navigator.userAgent) with no protection (unlike the HttpOnly flag), so does this alternate method add much protection in that case?

(this also reminds me, we should flip the default for HttpOnly to true).