You could log the IP and browser string at the first connection, and subsequent connections would need to match those fields. Not foolproof, but a start.