note 17160 rejected from function.session-destroy by zak

I've noticed a problem that I haven't been able to work out an elegant solution for, in the case of browsers which restore Cookies to previous states when hitting the Back button (I have noticed Mozilla do this in particular). Imagine you've got three pages: login-form.php, do-login.php, and logout.php - these do as their names suggest. All three call session_start() which used a MySQL-based session storage system. You fill out the form in login-form.php, submitting it calls do-login.php. You then log out, calling session_destroy(). Now, if you go Back 2 pages to the login form (directly, without visiting the intermediate login script), the browser shows the form as it was when you filled out the login fields, PASSWORD FIELD INCLUDED. This means that even though the session had been destroyed at logout without any problems, a malicious user need only browse back to the login page or a cached copy thereof, and just log right in. What is the elegant way around this? I've thought about using No-Cache headers, but that wouldn't help in the case of really malicious user agents that cache everything.