It's not just NAT that will cause problems like this. If two users access your site using the same proxy server, you'll have the same problem.

Also, a single user's requests within a session may come from different IP addresses. This could be due to users with short-lived DHCP leases (some cable ISPs do this), or users who are accessing your site through a proxy farm or hierarchy of proxies (see section 1.4 of RFC2616).

I'd suggest you only consider using this technique when you know exactly how your users are accessing your site, for example on an Intranet system that you know will never be opened to the outside. Even in these situations, you can never predict future requirements, so use another technique if you can.