Delete Cookie When Leaving Site

Product Cart uses Sessions and doesn't store a cookie. When the session expires, the user is logged out. If they just navigate away from the page and come back the session doesn't automatically expire. If they close their browser window altogether that will usually end the session unless they have multiple browser windows or tabs open in which case the browser will usually still retain the session.

The lock icon is displayed when the user has HTTPS at the beginning of their URL. In Product Cart, SSL is not enforced until either the beginning of the checkout process or the payment page (depending on the setting in your control panel). There is no real need to use SSL until that point just because a user is logged in.