Security and privacy

Tell them not to.

As the web is stateless this doesn't make sense. There isn't a terribly effective way to tell that a user is logged in - remember it's primarily done with a cookie on the the client.

While it's theoretically possible (by hacking the code) to, say, prevent any user who has shown activity in the last 15 minutes from logging in from a different IP address it's a very poor solution. It mostly penalises your uses by inconveniencing them and, potentially, breaks Moodle completely for users behind certain types of firewalls.

Don't do it - find a different way to solve whatever problem you think you have.