Session not ending if browser is closed before the timeout

Here's a first attempt at a patch. While it doesn't delete the session when they close the browser window, it does clean up sessions that should have expired when cron is run.

One thing to bear in mind is cron is using a different $_SESSION to the user, I would have liked to have loaded up the session and checked the autologout_last, but had to use timestamp from {sessions} instead, because:

1. There's no simple way of unserialising session data;
2. Switching between sessions using session_id() is ... tweaky;
3. Even if either of the above worked it can still be horribly broken if the user has the Suhosin hardened PHP patch applied and session data encrypted.

That last patch had a bug, I used the $result variable twice in two nested loops. Here's a better one.

Here's a new patch with the cron problem fixed.

I've committed the patch in #5 to 6.x-4.x branch as it looks like it's working great.

Changing to 7.x-4.x and needs work so this can be added to the 7.x-4.x branch if needed.

I have a (possibly) cleaner solution to this problem and attach a patch for 7.x-4.x branch.

The current solution is to clean stale sessions up via cron which can be quite costly from cron and also means that you have to wait for cron to have worked before the session_limit module knows a user has a free session.

Instead, this patch cleans stale sessions at login. My initial testing shows this to be a valid solution but I'm going to write some automated tests to prove it in a cople of different situations.

I'd be interested in other's feedback on this approach.

Same patch with tests showing stale sessions cleaned up at login.

I like this approach so am committing to development 7.x-4.x branch. Will leave 6.x as it is for the time being.