note 88278 deleted from session.security by salathe

Note Submitter: justin at fatbird dot ca ---- IP checking is a sometimes useful feature with two limitations that are important to be aware of: 1. Anyone surfing behind a proxy (e.g., someone at work) will provide the proxy's IP, not his own. Session ID replay attacks will not be prevented by IP checking for an attacker on the user's side of the proxy. 2. If the PHP application is behind a reverse proxy, the reverse proxy's IP address will be the only request IP seen by PHP, so IP checking is useless.