As for the first scenerio, this is by design. When playing with sessions with one browser instance:
User 1 logs in. Does not log out.
User 2 logs in. Upon logging in, you have PHP send a new session ID to the browser. Browser overwrites User 1's session ID. Essentially, User 1 is now logged out and User 2 is logged in.
User 2 logs out. PHP kills the session and its now longer valid. But technically, User 1 got logged out in the last step.
The 2nd scenerio is along the same lines. User 1 logs in twice using two different browser windows. Notice here its using the same browser instance. When User 1 logs out of browser one, the session is deleted. But User 1 in browser window 2 gets logged out as well and this is because it was probably using the same session which got deleted.
This is pretty much by design of the browsers. You could either live with it, or try re-inventing the wheel by building your own session handlers.
If you want to make things interesting though, try repeating your tests, but instead of using 2 of the same browser windows, use 2 different browsers. You should find your login/logoff code works as you were expecting.
