Handle the main form
FormClosing event[
^] and auto log out there.
It may be worth your putting a timeout on logins, so they are only valid for a finite period, or issuing them with a session ID so that you can tell when a session reached an abnormal termination and the login shoudl have been invalidated.