Security I implemented in the 90's: Encode the client IP address into the cookie.

Also include a timestamp to force re-authentication at some point.

This isn't rocket science.