In case of SAPGUI, Dialog and RFC logon - the connections are continuous.
In case of HTTP login, the connection to the application server is not continuous. (meaning the browser is closed )
So this may be the case
1903478 - Session remains open after the logoff on enterprise portal from 7.1 to 7.3
SAP notes 1322944