protected function validate($session, $request)
    {
        $locked = $session->get(self::LOCKED_FIELD);
        return !($locked['ip'] != $request->getClientIp()
            || $locked['agent'] != md5($request->server('HTTP_USER_AGENT')));
    }