sessionauth authentication service must check for IP

[bergie]

to prevent session hijacking, it must be possible to disable this check via configuration for cases where admins do not care about session hijacks.

Added bonus would be if the IP check could be disabled separately for admin and user accounts, so normal users could be open to hijacking (or to put it other way; have their long session on mobile devices "just work") but admins would not.