Remove sign in when authenticating already authorized apps.

I'm submitting this to start a discussion on whether it'd be worthwhile and to raise any security concerns that it might cause. In particular, given that there have been reports of session issues with the forums, I want to make 100% certain that there would be no such issues with Core. Additionally, it might be worth making sessions expire when someone tries to use that session id from a different IP address, though this will cause shortened session times for those with dynamic IP addresses, or that switch the location of their computer often.
Hrm, remote addr is not super reliable, people with laptops move around and home dhcp leases change. Would it be okay to let people change IPs?