replace login by email cookie check with IP address check because users sometimes open the login link on a different device