I too have been fighting with this "bug". The PHP session is not being closed properly. Something is left on the client so that when they press the back button, the server immediately recreates the session. At the moment, I can't figure out what to do - but I tell the client to close the browser in my logout page. That!!! closes the session.