The difference that you're looking for is the difference between active and passive voice.
session must expire - active voice
session must be expired - passive voice
As stated by Maulik V in the comments, the correct sentence is
Once the browser is closed, the session must be expired
Notice that we are using the passive voice in both parts of the sentence.
We use that voice because subjects - browser, session - can not execute the action by themselves. If the browser closes abruptly, we are talking about a malfunction. Usually, you close the browser by clicking in the 'x' button.
The same occurs with the session. The session is the set of data collected from an user, it's only data, it can not expire itself. Someone has to erase it when a timeout is reached or the browser is closed. That someone is usually a part of the program that serves the web pages.
But you can use both forms in this context
session must expire
session must be expired
The first one is used if you are not part of the develoment team that must implement the session expiring mechanism, if you don't care how the session is erased or if you don't know that a session can not erase itself. The second sentence is used to emphasize that such mechanism must be implemented to fulfill the requirements.
Best Answer
I would say they are both correct, and have the same meaning in this context. The difference between "a" and "any" is hard to explain, but you can think of it like this:
Is there a house? Yes. Are there any houses? Yes, there are 3.
If there is a house, there is one house. Even if there are multiple houses, one house is included in that.
If there are any houses, there are some houses there. There may or may not be more than one.