Fluent's session driver doesn't store any information about when a session was last seen. As far as I can tell, that makes any sessions that weren't destroyed via an explicit log out from the same browsing context as the original session very difficult to remove from the database safely.

A simple solution would be to maintain a timestamp in the __fluent_sessions table that is updated every time the session is retrieved. This would at least make it possible to periodically clear out definitely expired sessions with a simple query.