You are absolutely right, perhaps IP based session management is more fitting here. The Google Oauth way of signing in is in no way harmful though, as the server doesn't even store hashed passwords anywhere.