A session is active until it is terminated
when the user logs off
when the session expires
when an administrator disables a user
when user hits another URL