disclosure of IP address in cookie

[Manuel Haim]

> Are you perhaps using the Memcache IdP storage plugin?  That plugin sets
> the _idp_authn_lc_key cookie.

Just to clarify: That cookie is not set by the memcached IdP plugin, but
(as Scott said) by the IdP itself. The reason why it is mentioned along
with the plugin documentation is because the underlying "login context"
is not shared among several IdP nodes through memcached, thus the load
balancer needs to be aware to forward requests to the appropriate IdP
(which set the respective cookie value).

-Manuel