Closing the browser should retire the SessionID and key-pairs and preferably, the server should send a message to retire the session. The server may refuse. Adding user credentials again is not needed but may be requested by the server. The protocol requires on the strength of the security protocols used. Such attacks can result fast into many known-plaintexts with there accompanying ciphertext.
Servers require significanly more performance to do the job.
Requires browser and server support. Long expire-times give the adversery a good chance to do damage. If a false message was detected that was incorrectly signed, the server should notify the actual owner of the session of this attempt. It's recommended to retire the session. On the other hand, the session can probably continue to exist, because this security is more difficult to break, than with the cookies.