Question: I have some questions about XMLHttpRequest using $.Post $.Ajax:

1- How the server side verifies if the request was sent from same browser?

2- How the server side verifies if session user who sent the request has been changed on same browser? (ex: user logout and another user login on same browser)

3- Do I need any special settings or PHP code at server side for #1 and #2?

Also please give me a link to good documentation about any security issues related to XMLHttpRequest. 

Thanks

Answer: 
1. Browsers and servers use cookies to check whether request was sent from same browser. Every request will have cookies attached.
2. The basic idea about the sessions is simple. Whenever you send a request to the server, the session variable (if present) will be sent along with the request to your server.
Again, if you modify anything in session or clear the session, the response will contain the modified session. Since both request and response contain sessions, they can operate independently.
3. By using $\_SESSION in PHP, you will be able to retrieve sessions in server. Just use $\_SESSION['userid'] == to check whether it's the same user.

I understand you are a PHP person but take a look at node.js request and response objects for a better clarity about sessions.
Also you can encrypt session variables in server for security. Code Igniter session library is an excellent example for this.
1. It doesn't
2. By whatever mechanism it uses to track who is logged in for any other kind of request (presumably the data your server side application stores in the session will change)
3. No