1. Embed an ephemeral encrypted token (https://owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF...) in the HTTP response header that's signed with an HMAC-SHA-256 signature.

2. Sign sensitive requests similar to how Amazon does for AWS API requests (http://docs.aws.amazon.com/general/latest/gr/signing_aws_api...) -- just make sure your signature is secure (http://www.daemonology.net/blog/2008-12-18-AWS-signature-ver...).

3. Use client-side certificates by using the HTML5 keygen element to have the browser generate the client's public/private key pair, and then have the server sign the client's public key (http://security.stackexchange.com/questions/27961/should-the...).

4. All of the above.

One technique is to hold other information along with the session cookie, such as the client IP.

This isn't perfect, because there will be false positives that log people out fairly often, but it would make session hijacking significantly harder.

I use a laptop and carry it between work and home, occasionally signing in to a VPN. My IP address changes several times a day.

Add a hash of the userAgent in the session. How about adding some shared secret in the browser's localStorage?