It depends.
If your requirement is to terminate "inactive" sessions("old" = "inactive" ?) then you could simply rely on SAS time-out values : Stored Process or Pooled Workspace sessions are supposed to be closed automatically when the time out limit has been reached (30 minutes by default on 9.2 SAS EBI). However, if you want to kill any SAS web session, either "active" or "inactive" then that's a different matter.
If you have SAS 9.3 or beyond then you could try using Procedure IOMOPERATE to list active user sessions meaning running SAS sessions like Stored Process or Pooled Wk server - and stop them :
http://support.sas.com/documentation/cdl/en/biasag/62612/HTML/default/n20000intelplatform00srvradm.h...
If you want to terminate SAS Web sessions with no corresponding SAS sessions, then it depends on your implementation : J2EE Application Server like Jboss and/or front-end http Server like Apache could be accessed with different tools to forcibly terminate user sessions according to a set of given rules.