Do you understand that this only happens with multiple windows of the same running browser? If different users each log in to the computer and run a browser, they are not sharing the same one. If a user logs in and never logs out, and someone else shares that same account on the same computer, then of course the session on your site will remain in effect. All that you do about that is use a short inactivity period on your sessions.