ASP Session Does Not Expire

understand that when one closes the browser, the session gets killed in ASP,
i encountered a scenario, where even after the browser was closed, the session was active, let me explain, i have written a code to check if the session variable contains the loginname then i am allowing access to a certain asp page to the user.

the code worked. thereafter i closed the browser, opened the browser again and accessed the same url, surprisingly it allowed access to the page and did not ask me for the login name, clearing the cache also did not help.

Further, I need to update some table as well when the user closes his browser window (an update query to set the flag to 0 for tracking user status). How can I do this. A sample code will be highly appreciated.!

Lastly, when the user clicks the logoff button, he successfully logout , but he can come back with the back button on the browser. Is there a way to prevent this,that is, once the user logout and tries to come back, he SHOULD NOT be allowed to do so rather he should be redirected to a page where he can login again.