sessions and authentication

[eluser]wiredesignz[/eluser]
It should be optional.

logged in should be db session IP based, and user auth should be user_id cookie based.

pull the user unique_id from their account into a cookie and store their IP + id into a session db.

if someone else logins in they get the unique_id but the session IP fails to match.

if the genuine user leaves and comes back they still have the cookie and the session IP matches