"I want to know how to expire a session once the browser is closed."
This not possible because you cannot reliably detect when a browser is closed.
The best you can do is assume that the browser is closed after X minutes of no activity.
Andrew's suggestion of setting the cookie's time-to-live to zero does not help in this case because all you have to do is add the sessionid to the URL and PHP will re-open the session for you.
Another good question is this: how is it possible that a user only needs to send the sessionid in order to continue as loggedin?
Apparently all the logon data is stored in the session, so if someone can read your sessionid and enter it into his URL, he's logged in as you. Bad bad bad.
A simple solution to this is to add another cookie that is set when the user enters his username and password.
After loggin in only the 'real' user will have the cookie, so you can verify that it is the 'real' user by looking for the cookie. No cookie, not logged in, force a new logon.
Now mix that with Andrew's zero-time-to-live on the cookie, and the cookie will be destroyed when the browser closes.
If the user restarts the browser and enters the URL with the sessionid, he nolonger has the cookie and thus he has to do a new logon.
