Technically, you can't kill a user's session upon them
closing the window.
What you _can_ do is use J2EE session tracking, or a
transient cookie that gets deleted when the browser quits. That
still doesn't kill the session when they close the window. The
session remains active until the timeout time has elapsed.