- arbitrary user, session and request IDs

- this can be done and then discard the address

- how so? What does knowing the address months later help? Something like fail2ban and other automated systems, sure, but long term logging?