Web Security: Worst-Case Situation
THe one thing I miss besides everything that is mentioned is fixing "all other security problems". 

If you have a SQL injection, you're effort on the cookies is a waste of time.
If you have a XSRF vuln, you're effort on the cookies is a waste of time.
If you have XSS, ....
If you have HPP, ...
If you have ...., ....

You get the point.
If you really want to cover everything, I suggest you get the vulnerability landscape clear and build an attack tree (Bruce Schneier).
I currently have built a system that checks user IP, browser, and a random-string cookie to determine if he is an admin.
In the worst case, someone steals my cookie, uses the same browser I do, and masks his IP to appear as mine. Is there another layer of security I should add onto my script to make it more secure?
EDIT: To clarify: my website accepts absolutely NO input from users. I'm just designing a back-end admin panel to make it easier to update database entries.