Log out on browser close.

Previously, we were using persistent (non-session) cookies for the
session. That meant people would close the browser or shut down the
laptop without logging out... and then it'd still be logged in when
someone opened the browser again.

Not good.

Closing the browser should log you out. So use a session cookie.