The who's online count is a count of the http sessions that are established, if you close the browser it doesnt close the session so the count wont go down until the http session for that user times out. That is why this happens.
In a nutshell http has no way of detecting that the user has closed his/her browser because there is no connection maintained between the application and the web browser.
Does that help it make sense to you now?
Is any where I can config the session timeout?
I thought it was under the nukes core module in JMX console, but I dont see it there. Someone else might be able to answer that question better, but if I come accross the answer I will post it.