session_protection = "strong" kills sessions restored from remember_token

[elandorr]

As per docs

If the session does not have an associated identifier, the one generated will be stored.

Instead, it kills the session.

Wouldn't it make sense to store the identifier for 'remember-sessions' inside the remember_token? Then we could still verify the browser/IP haven't changed, and the remember_token wouldn't be a blank pass for potential cookie thieves.