Session fixation IP address check

I changed the session fixation test to use the IP service. It was only checking REMOTE_ADDR which would remove the protection if the server is behind a reverse proxy.