Honour the global variable $cookie_domain, as set in settings.php -- except when set to .localhost (illegal), in which case ini_get('session.cookie_domain') is used.
Add another optional source for session id: IP address (so that cookies need not be used).
Fixed #2210329: setcookie is called multiple times (SESSION_CACHE_STORAGE_DB_CORE)