do you know that the onunload is fired for every page event from a refresh, to clicking on a link, to closing the browser, to navigating away. Now you may be causing your user's to log out when they were not leaving the page.
Let your server handle the clean up on session end. You can not rely on the browser's event handlers. Plus what if JavaScript is disabled?
Eric
She's out of the country right now, toppling an unauthorized dictatorship. Please leave a message with this tiny ad:
a bit of art, as a gift, the permaculture playing cards