User sessions terminate through valid mechanisms: user logout (explicit termination), session expiration (timeout), or administrative action (disabling user account). Hitting another URL is just session activity, not termination. All three listed scenarios are correct.