Differential privacy on multiple queries – what is the behavior?
It would be helpful to have a link to the paper you are referring to. But the basic composition theorem says that each query $i$ an attacker sends to the database will just add its corresponding $\varepsilon_i$ to the total $\varepsilon$ of the entire process: $\varepsilon=\sum_i\varepsilon_i$. So "session" probably means "single query" in the context of your question.

And yes, your objection is a good one. If you use differential privacy in an interactive context, then you need to either:


split your total privacy budget across all users (and when it runs out, stop anyone from querying the database);
or assume that your users are not collaborating, and have some authentication in place to make sure each user cannot go above the privacy budget by connecting to the system as multiple people.