Token not expiring when browser is closed

[shipswake]

We have a rather odd occurrence here

We are using refresh tokens to renew the token.

Steps to reproduce:

Set the token and refresh token lifetimes short (300)

Login

Close the browser

Wait until the token and refresh token have expired

Open the browser

The user is still logged in and there is no redirect

Any thoughts on what we have missed?