note 16698 added to function.session-destroy

I can't figure out how to solve the problem of browsers caching the sessionID. i am using user authentication on a collection of scripts i am working on. when a user logs in a session is started with start_session(); session_register("username"); session_register("password"); (variables taken from a form). the login script is passed from page to page just fine with an include('login.inc.php'); at the top of everypage that i need protected. when a user wants to logout a page named logout.inc.php logs them out with session_start(); session_unregister("username"); session_unregister("password"); session_destroy(); it logs them out, all variables are unregistered and session_destroy deletes the sessionID from the servers tmp directory. however, if a user then hits the browser back button they are taken back to the secure page where they are presented with "Warning: Page has Expired".... If they then hit refresh they are presented the secure page with all previous session variables intact. i assume that the broswer cache is responsible. however, i thought no-cache header functions were built into sessions... i can't make any sense of it? this is definately unacceptable secruity for my site. if a user logs in, logs out and then walks away from the computer without closing the browser and then another person imediately sits down, hits the back button they are instantly logged into the secure part of the site. i know this scenario may seem unlikely to some, but it is still a scary thought to me. has anyone else encountered this problem? has anyone figured out how to correct it? if so, could you please explain. -- http://www.php.net/manual/en/function.session-destroy.php http://master.php.net/manage/user-notes.php?action=edit+16698 http://master.php.net/manage/user-notes.php?action=delete+16698 http://master.php.net/manage/user-notes.php?action=reject+16698