before we talk about hardening we should talk about updates:
https://github.com/Icinga/icingaweb2/releases/tag/v2.9.9
or upgrades:
https://github.com/Icinga/icingaweb2/releases/tag/v2.11.4
concurrent session restriction is not possible but I think this can be achieved with writing a new module.
the same applies to useraccount lock.
but here are my google search results for your session problem: