Comment by amarant

Add a client IP field to the JWT. Token is only valid if the request comes from the associated IP. Done.