Product Cart uses Sessions and doesn't store a cookie. When the session expires, the user is logged out. If they just navigate away from the page and come back the session doesn't automatically expire. If they close their browser window altogether that will usually end the session unless they have multiple browser windows or tabs open in which case the browser will usually still retain the session.

The lock icon is displayed when the user has HTTPS at the beginning of their URL. In Product Cart, SSL is not enforced until either the beginning of the checkout process or the payment page (depending on the setting in your control panel). There is no real need to use SSL until that point just because a user is logged in.

I just realized that if you have an ssl certificate installed on your site and are logged in (which displays the lock icon), when you leave the site without logging out and return to the site, you are still logged in BUT no lock icon is displayed. The lock icon will come back when you try and checkout, but shouldn't it be there if the cusomer is logged in at all? When a customer leaves the site, is there a way to delete the cookie that tells the site the customer is logged in, so the next time they return they will have to login again?

Thanks in advance