The IP address component of cookies was removed in 7d18c40b83.

Index: src/login.c
==================================================================
--- src/login.c
+++ src/login.c
@@ -1051,11 +1051,11 @@
     }
     if( zUser==0 ){
       /* Invalid cookie */
     }else if( fossil_strcmp(zUser, "anonymous")==0 ){
       /* Cookies of the form "HASH/TIME/anonymous".  The TIME must not be
-      ** too old and the sha1 hash of TIME/IPADDR/SECRET must match HASH.
+      ** too old and the sha1 hash of TIME/SECRET must match HASH.
       ** SECRET is the "captcha-secret" value in the repository.
       */
       double rTime = atof(zArg);
       Blob b;
       blob_zero(&b);