When the user hits refresh the browser is refreshing the entire frameset. IE if you have the frameset url as http://www.mydomain.com/ which causes a frame to load with the url http://www.mydomain.com/sessionid=123987129837 then when they hit refresh the broswer will load the first one causing an entire new session to be created.
Your best bet is probably to try and backup your URL based session ID with a cookie. This won't be perfect as anyone with cookies turned off will of course still get kicked out but it will catch most users.

---If it doesn't fit use a bigger hammer