How to reset/save $_SESSION variables in forms for each user? I need to add captcha to user login form after 3 failed logins.

To do so I built the following module, and used $_SESSION['failed_login'] to keep track of the number of the failed logins.

This module works well, but when I close the browser and test a failed login again, the number that is stored via watchdog will not reset again from 1, it continues increasingly. 

&lt;?php 

function failed_login_form_alter(&amp;$form, &amp;$form_state, $form_id) {
    if ($form_id == 'user_login') {
        $form['#validate'][] = 'failed_login_myloginhandler';
    }
}

function failed_login_myloginhandler(&amp;$form, &amp;$form_state) {
    global $user;
    if (!$user-&gt;uid) {
        if(!$_SESSION['failed_login'])
            $_SESSION['failed_login'] = 0;
        $_SESSION['failed_login']++;
        watchdog("error", $_SESSION['failed_login']);
    }
}


What is the problem? Why it is not reset from 1 again? How can I have this temporary variable for each user who is trying to login?
By default Drupal's sessions are kept for about 23 days. You can modify this in settings.php. Look for gc_maxlifetime and cookie_lifetime to reduce it to 0 so sessions are destroyed when the browser is closed.

This will effect logged in users too so when they close the browser they will also be logged out.

On a side note if you were unaware drupal already have flood control and will block IPs for multiple failed login attempts