The difference that you're looking for is the difference between active and passive voice.
session must expire - active voice
session must be expired - passive voice
As stated by Maulik V in the comments, the correct sentence is
Once the browser is closed, the session must be expired
Notice that we are using the passive voice in both parts of the sentence.
We use that voice because subjects - browser, session - can not execute the action by themselves. If the browser closes abruptly, we are talking about a malfunction. Usually, you close the browser by clicking in the 'x' button.
The same occurs with the session. The session is the set of data collected from an user, it's only data, it can not expire itself. Someone has to erase it when a timeout is reached or the browser is closed. That someone is usually a part of the program that serves the web pages.
But you can use both forms in this context
session must expire
session must be expired
The first one is used if you are not part of the develoment team that must implement the session expiring mechanism, if you don't care how the session is erased or if you don't know that a session can not erase itself. The second sentence is used to emphasize that such mechanism must be implemented to fulfill the requirements.
must
andmust-be
not differences at here?Requirement 1 This requirement is easily implemented by setting SESSION_EXPIRE_AT_BROWSER_CLOSE to True.
link