Use session key instead of IP for identifying users.