how to delete cookies in perl

A cookie is deleted when the browser receives a Set-Cookie header for the same cookie-name with an expiration date in the past. The CGI module can handle the mechanics of this, but it would be better for you to read and understand the documentation while you're still figuring out how cookies work.

It makes sense to leave a persistent cookie on the user's computer that identifies that user (or the last user who logged in). If the same user returns, you can make the login procedure a bit friendlier.

In addition to the user identifier, you could have a second cookie which is a session identifier that is not saved, it is used only while the browser remains open. These session-only cookies are created by a Set-Cookie header with no expiration date specified. The session identifier could have a start-time encoded as part of its value so your script can rapidly see whether the session cookie is stale and you could automatically renew the session cookie occasionally so the user need not login again while still active, even if they keep using your site for hours (or days!).

When a user logs off, you can delete the session cookie as part of the response screen saying "You are now logged off".

When you receive a request with no session key or one that is too old, you simply send the user to a login screen.

There is no way for you to detect that one user has taken over a browser session from another unless they tell you. If I let you sit down at my screen while I still have a session open, I'd better watch what you do, since to all the rest of the world, what you do is being done by "me". Having sessions time out prevents a portion of the cases where people forget to log off, but if someone new slips in under the timeout window, you'll not be able to tell.

IP addresses cannot be used to uniquely identify users in general. Many users will reach your site through proxies, firewalls, or other shared hosts that will not have a unique IP address per user. You can record the IP address for logging and forensic purposes, but all by itself it is not a substitute for a user identifier.