1 session per account is pretty useful, that way it's less likely users will borrow their account to other people. IP restrictions is another soloution.