We are not actually keeping track of sessions in the stats. We update the user.LastActivityDate on every page request. We show all users whose LastActivityDate > DateTime.UtcNow.AddMinutes(-Session.Timeout);
So it doesn't matter if they actually have a session, its not really based on tracking sessions. We just use the Session.Timeout for convenience as the window of time when a user is considered online.
We don't actually use any session variables in mojoPortal. We do count sessions by incrementing a global variable in Session_Start and decrementing it in Session_End (in global.asax.cs) and this is used for the count of users online.
Hope it makes sense,
Joe