#1 Session expires in two ways: #1 when no timeout set the session
expires after browser is closed; #2 session times out after the timeout
limit is reached (the timeout extends on each request), but survives
browser's shut downs.