lockout based on IP and user agent