My web service is an API-driven Single-Page-Application. Once the user logs in they're given a temporary token to use for the rest of the session which is sent along with each API request. The token is of course tied to the IP address that performed the login request. This means that even if a 3rd party somehow managed to capture a token despite TLS, they probably couldn't use it and it wouldn't be usable by anyone at all after the current session ended.
But I recently came across a user whose IP address changes with extreme frequency (as frequently as every 30 minutes) causing them to frequently need to re-log-in while using the service. The address change is caused by on-campus dorm internet that recycles a very limited pool of IP addresses that the end-user of course has have no control over.
How can I reconcile keeping the security of my current setup, while also not causing users in this situation grief? The best 'middle-ground' I've got so far is loosening the IP requirement to only match the first octet of the address, but that's far from ideal.