Okay.. I've seen a number of other threads called this.. none of them are helpful.
When someone logs into my site.. I register a session variable called LOGGED_IN set to TRUE.
When they log out, I call session_destroy() which SHOULD destroy all data associated with the session and murder the LOGGED_IN variable.
But.. click "back" and "Refresh" will let you back into the menu. How this works, when LOGGED_IN shouldn't exist anymore, I have NO idea.
/Mike