if the same user login from the same IP address with no session id, just clear up his previous sessin context from the server, and let him login.

Uhm, no. Multiple users can share one IP. The most common way this happens is with proxies. Similarly, a single user might appear to come from multiple IPs over successive requests. (Think proxy farms.) The IP is not reliable and your solution does not address his stated problem. Unfortunately, there is no real clean solution to it. The bottom line is that you really have to rely on the authentication credentials. That's really not so bad, though.

-sauoq
"My two cents aren't worth a dime.";