Taken from link
When a session is created b/w the browser and your server (Jboss and liferay in this case), it puts a cookie on the client's browser that identifies the session. That cookie is probably set to expire when the browser closes. So when you re-open, the browser no longer has that cookie, so it can't identify with any session. So, from a technical sense, the session on the server side isn't closed technically. That happens when the session expires, usually a set period of time from inactivity. For a session, there are usually three ways it gets destroyed on the server side - a logout (which the app destroys the session), a period of inactivity (could be 15 minutes or whatever), or a "hard" timeout, you may want your users to always re-login every 8 hours for instance.
So in other words, even if the browser closes, the server doesn't know it and the session is alive and well until it expires. Login is only required bc/ the cookie is flushed when the browser closes. Now, when a tab closes, the browser doesn't necessarily close so it still has that cookie.
One way to do what you want would be to have a Javascript hook that gets called (like an event) when the tab closes. This javascript could call a servlet or web service to let it know to destory the session.