Destroying sessions, but am I?

All right. I thought I had a good handle on this session stuff, but I don't think that I do now. I'm programming an application that needs to be relatively secure and maintain data across separate calls to the script... ideal for sessions. I'm not sure if I'm not understanding how sessions work or what, but this is what is going on. I create a session, pass PHPSESSID throughout all calls to the script once created. I'm only concerned with when a user exits the script for the time being, so upon logging out, I start the session, (session_start()), destroy all variables (session_unset() I believe... don't have access to my code right now) and then destroy the session (session_destroy()). Problem is, the session file is still sitting there on the file system where it was created by the script. so although all the variables have been cleared, the user can just hit back, and lo and behold they are back into the script where they should not be able to go once they log out. The user also has a link that they can use to go back to the main page of the script, and since the session isn't being destroyed, they are basically afforded free access to data they should not be able to access (yes this is easily fixed with a few lines of code, but that is beside the point.) The session is not being destroyed. Am I missing something here? Shouldn't session_destroy() remove all elements of the session from my file system? Oh, On all other calls to the script (besides the logout call) I start the session (session_start()) and register my variables (session_register()) Any ideas out there in guru land? lol Ben