many other secure sites do have this issue, so it's not specific to AA.com. I just don't know how fixable it is.
It is not related to SSL. It is just bad design. The user thinks they are using a web site, but the developer thinks they have written a single-window application. This is a pet peeve of mine when sites break standard functionality of the browser.
Most frameworks give you a single site session per browser session for free. It takes a little more effort to implement session-per-window.