Function session_key 

pub fn session_key(principal: Option<&str>, remote: IpAddr) -> String

What a session is counted under: the principal, or the remote IP for an anonymous caller, so one address cannot hold unlimited anonymous sessions either.