Also, make sure that every time someone performs an action on the site, you generate a random number. Add that random number to the number of seconds since their last performed action. If that number exceeds a threshold (that is assigned randomly and valid for a randomly assigned amount of time) delete a random part of the session.