How do I guarantee a single session?
===

I need to **prevent** the situation where either 
1. Two different JSESSIONID's exist for the same user account or,
2. Two tabs of a single browser reference the same JSESSIONID.  

Any suggestions?  If an existing session is detected, the user can either:
a) Quit the second attempt
b) Kill the existing session (an assassin!) and start a new session.

The preference is for a sever-side solution.  That is, I don't want to depend on user's turning cookies off which forces the JSESSIONID into the URL.