Additionally, disabling "Enforce IP addresses for sessions" is bad because if someone does manage to intercept or steal your session ID, they can use that directly. They should not be able to do, but it is better safe than sorry.

Side note: Session ID complexity was increased even further in v11.

In v10, IDs were 13 character hexadecimals (base 16). In v11, it has been increased to 13-character base 32 (0-9 and a-z except 0, o, 1, and l).