note 84423 deleted from function.session-start by peehaa

Note Submitter: michael at pythontech dot net dot au ---- @ash Whilst this may prevent session hijacking attempts, it also ruins the user experience, pressing back and forward will result in the 'security' token being out of sync. Also opening new tabs/ windows will also cause issues. A better method would be to simply check the ip address or ip block of the user. But this is not without problems either. To access highly sensitive information, the user should be required to enter his/her password again, even tho they are logged in. This ensures that session hijackers can not access this information. All this goes hand-in-hand with regenerating session ids on login, and good use of https.