That's not really true. You could easily add another piece of information to your session that is derived from something stored with the user (for instance a r

That's not really true. You could easily add another piece of information to your session that is derived from something stored with the user (for instance a running counter). So if someone runs away with your session you add a button "logout everything" which increments the counter. When the session is accessed for the next time the counter values don't match and the user is logged out.