I'm not sure what the right solution is, but tying tokens to IP addresses is probably not workable. Better mechanisms for protecting tokens stored on the devic

I'm not sure what the right solution is, but tying tokens to IP addresses is probably not workable. Better mechanisms for protecting tokens stored on the device seems like the only way to reasonably improve this situation.