that would work, assuming the user is responsible enough to logout explicitly. That may or may not be realistic.
even with the application variable approach, you'd have to worry about user's simply walking away from their machine, so with either approach, you'd have to develop a mechanism that times out.
You'd want something you could refresh whenever there is activity. I'd hate to track that with a DB call everytime. I'd still go with the application variable because everytime that user loads a new page, you could refresh the variable. If the user walks away, that variable will disappear automatically once the timeout has been reached (right?)