I do not like Code First. Database First encourages one to carefully consider the modelling with considerations for normalization and database performance (which is often a bottleneck in systems). There are also many tools out there for modelling databases which makes visualizing and collaborating on the model easier. Finally, I just don't trust Code First to make the right decision for generating schemas for large or slightly complex models.

If user doesn't log out before closing the browser, I don't think you have a choice but to wait for the session to expire. Except for... I did write an application once where I needed to positively know that a user's browser window was still open. I added a heartbeat feature so that the server would know when the browser was closed. Consisted of an empty paged named heartbeat.aspx page that had a tag. This causes the page to get refreshed every 30 seconds. Then include the page in a 0x0 pixel frame on all your web app pages (using a master page). Now every page of your application will have a heartbeat. Just add code-behind to hearbeat.aspx to automatically log them out if you don't get a heartbeat for over 30 seconds (or whatever value you want). Obviously not something you want to do on a high-traffic website but sounds like your application is low traffic - i.e 1 user at a time ;)