If the record in the session, the user disable the cookie, you will not have the effect?
If according to the login user name, recorded in the system cache, the attacker log on each time you change the user name, as will the image of system performance.
How to find the unique identification of the client, the client records logins, increasing the difficulty of attackers.