We are using a framework to make "sessions" a breeze with absolute peace of mind. Codeigniter has a framework which has issues a sessions id whenever a member login. This sessions id is active only for the period of time the client browser is open. The minute it is shut off, the sessions id become invalid, and a new session has to be restarted requiring a new login process. All urls must pass the session id test, making the whole issue of security a simplified process.