You can hash all that info, so if the user provide the right info (ip, browser string whatever), then the session key would be reconstructed as true.