http://us2.php.net/header
Says the following:
Note: HTTP/1.1 requires an absolute URI as argument to Location: including the scheme, hostname and absolute path, but some clients accept relative URIs. You can usually use $SERVER['HTTP_HOST'], $SERVER['PHP_SELF'] and dirname() to make an absolute URI from a relative one yourself:
There is more information here: http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.30
I don't know for sure, but the client may be hiding the session cookies from the server because of the malformed Location parameter. If you want to help find the common denominator:
session_start();
if (empty($_SESSION['username']))
{
file_put_contents('/path/to/logfile.log', $_SERVER['HTTP_REFERER'], FILE_APPEND);
header ("Location: logout.htm");
exit();
}
The example is just a helper to see if you can spot similarities between problem browsers. Not recommended for permanent production use.