An easier way to detect something fishy would be to allow at most one connection per auth token, and invalidate it and re-request login credentials if a collision occurs. Just ping both connections first to make sure they're both actually alive, and not the same machine logging in again after a reboot-after-crash.