You did not misconfigure anything. I noticed the same thing and for the life of me could not figure out how to change this behavior. So I put in a ticket with VMware support.
The answer I got back was "This is expected behavior." So we have stopped using the vSphere Web Client all together. The only reason I still have it installed as a service is so that I can manage SSO but only from the local server.
We are running 5.1 but I was told it is the same behavior in 5.5. And being that VMware has moved a lot of functionality into the Web Client in 5.5 we will not be upgrading to 5.5 in the near future.
It is very disappointing that VMware has overlooked this issue. We have several thousand user accounts in our domain. And if we were to leave the Web Client running every last one of them could log in. Unacceptable.
Better fix this in 6.
-Bill