Here are a few ideas beyond the ones already listed:

• Frames - (yeah, i know...) use a frameset wrapper with a hidden frame that refreshes itself every so often to verify the users presence (this may require more careful treatment of offsite links)
• Push images - this might load the server a bit, but as long as the image is being received by the browser, the user is there (IIRC it works on netscape, i'm not sure about the others, it users some sort of multipart mime type)

BTW- i'd personally use the 1-2 minute last access timeout system described in a few of the other posts, but if you need finer grained control, the ones here might work.