Someone just told me that when you close your browser, your JSP session (login in this case) is not ended, so that if you start up another browser and go to your site, the JSP engine still thinks your logged on. Is this true? If so, how to end that session before shutting down the browser?

When you close ALL instance of your BROWSER(i.e. windows), then your JSP session will end. But if you just close 1 window/browser and still have others open, you JSP session would still be considered active unless your set timeout. The session can be programatically invalidated anytime by calling session.invalidate(). Of course, the session can also be invalidated by the container if the user remains idle for a period greater than the one specified by the 'session invalidation interval' value from within the container's admin console or from within the code itself.