We had the same problem. Here's the code we used to get around it. It detects a POST and then send headers to allow the client to cache the result which override the ones sent by start_session().
// Here we check to see if it was a "POST"
// form submit and allow caching so the
// back button won't give page expired
// These headers must be sent after the
// start_session() call on the page
if ($REQUEST_METHOD=='POST')
{
header('Expires: ' . gmdate("D, d M Y H:i:s", time()+1000) . ' GMT');
header('Cache-Control: Private');
}
-Kevin