You would need to use a databas as one session is not aware of another. When a session was started it would need to check
that the user is valid (you already do that)
that the user name is not in the "currently logged in" list which is probably what they do at this forum.
Any timestamps older than X minutes would have to be deleted which means that the session would have to be ended automatically after the same idle time or a user could get a second session.
What if a user closes the browser and then decides to return, you will have to make sure you don't lock them out.