creating a web-app backdoor (utilising virtual server redirects) for internet users

thanks CB, after doing a little more thinking I believe in our prod environment, where the host (aka cookie setter) will always be abc.com (and not x.x.x.1, x.x.x.2) I think the cookie idea will work fine because the browser will send all abc.com cookies with the request. If not I'll investigate the source affinity persistence.