Log in with username and password without remember me.
Close the browser.
Open the browse -> still logged in.

I think the right use-case should be not logged in, if I have logged in without remember me - cookie must be expire at end of the session. Otherwise this is kind of security problem.

Session.php, row 698 fix with code:

change

$cookie_expire = $this->time_now+(($config['max_autologin_time']) ? 86400 * (int) $config['max_autologin_time'] : 31536000);

with

if ($persist_login)

        $cookie_expire = $this->time_now + (($config['max_autologin_time']) ? 86400 * (int) $config['max_autologin_time'] : 31536000);

      else

        $cookie_expire = null;