Getting remoteAddr and cookies into attributes?

[Rich Graves]

Newbie questions:

Q1) Can we get the client IP address into a (scripted) attribute with no or minimal Java code? Is there a reasonable way to pull in p:customObject-ref="shibboleth.HttpServletRequest" as in the SPNEGO examples?
Q2) Can we set an attribute to the value of a specific client cookie? (With some sanity checking of the user input, of course.)
Q3) Is there existing functionality we can leverage to set a new custom browser cookie, ideally without any new Java code?

I'm imagining a summer intern project to try to add "1.5 factor" authentication to idpv3. Has anyone else already tried this? The scheme I have in mind is like

1) Long-term browser cookie asserting "user X has logged on from this web browser before." This could be something stateless like computedId or stored in a database.
2) Database tables (possibly abstracted via a REST API like UW's Groups Web Service) recording ASNs and geocodes of previous known-good and suspicious logins (GULP). This could be populated either by IdP code or more likely by scraping logs (both shibboleth and non-shibboleth).
3) If a user who has NOT previously opted in to Duo 2nd-factor tries to login from an unexpected ASN/geocode without a persistent cookie:
  a) At least log the event. If the login is from West Africa, impose some sort of cooling off period or challenge.
  b) Show the user an interstitial "was this really you?" post-authentication flow the next time they log on from a known-good ASN/geocode/cookie-persisting browser.

I think #3 is achievable with a combination of scripted attributes and a fork of the context-check intercept flow, if we can handle the prerequisites of remoteAddr and cookie handling.