What happens when someone hits your app from a library computer? From behind a proxy? Have you thought about what happens when their IP changes?
Stop. You are inventing a crazy homebrew authentication system here. One great way to absolutely fuck your site's security is through crazy homebrew authentication/authorization/cryptography.
> Have you thought about what happens when their IP changes?
++. When I was walking this road, I answered that question with "I'll use the user-agent instead!" Then I checked that assumption, and the Internet told me that could vary between requests as well. That was the key insight (you can't trust anything) that put me on the road to a much more standard system. (But probably still insecure, since I was younger and working for someone with NIH syndrome.)
I previously did some work for an online poker service who had a financial incentive in knowing who was logging in as who and had a custom client with which they could do all sorts of nasty spyware-esque things to the client's machine. And they were still susceptible to hackers.
You have a browser for a client and HTTP. Please, don't end up on HN as sadly yet another cautionary tale for doing security wrong.
You'd have to also place a secret code on each page, and reject form data or user requests (e.g. to delete their data, etc.) if the secret code wasn't submitted.
