[imp] session not ip save

[jan gerber]

As a shock to me i had to realize today that IMP/Hordes implementations
of sessions is not IP-Save.

the least thing would be something like

$ipaddr = $REMOTE_ADDR;
session_register("ipaddr");

And when the user requests a document with sensitive data
verify his/her IP address:
if($ipaddr != $REMOTE_ADDR) {
   go to login page.
}


jan gerber