I've done both cookies and IPs in the past. Users coming in from dial-ups can always reconnect, delete the cookies and vote again, but that is such a pain in the 455 that I can't see someone doing it over and over and over. Even permanent IP users could spoof the address and do the same process, but that's even a worse case of nothing-better-to-do-with-ones-life.

#!/home/bbq/bin/perl
# Trust no1!