Actually tackling the problem, hmm. Storing a single cookie on the cloudflare domain so I only have to auth with CloudFlare once, would be better than nothing. I don't like the tracking aspect of that though. Maybe there's some kind of advanced crypto which will solve this in a privacy conscious manner one day.
Unless IPv6 takes off fast more IP addresses are going to be shared. It's simply a terribly crude measure to assume IP address = person.