(floc,ip) is for all intents and purposes unique. So just track that and you have your user. If floc changes - just look what floc is dead on that ip and matc

(floc,ip) is for all intents and purposes unique. So just track that and you have your user. If floc changes - just look what floc is dead on that ip and match to that user. If IP changes in same subnet (ipv6 privacy extension) just match new ip to old floc. Add in browser fingerprint for overkill. A sufficiently large network can identify a user if he's logged in anywhere and you have everything you need