Frankly, it\'s just causing too much hassle in in v1.0 to have a functionality which requires three form submissions, with $_SESSION
session data holding all of
If I were doing this now, I would probably code a single page AngularJs app (although any form of Js will do).
On start-up, look in local storage for a flag. If set, refuse to start, with suitable message, else set the flag & run the app.
Sure, a malicious user could get around it, since it's not a server-side check, but I would just refuse to support such.