The easiest, simplest method would be to put a timeout on their sessions. You know how and where sessions are stored and accessed, right? Also, you could just check to see if they have an existing ...