I am using a PHP login script that challenges user for username & password.

Once authenticated program stores a session value. On logout, session value is
set to blanks.

**Here is the problem:**

In IE 8 (not Firefox), user can hit back button a few times until the
screen which shows "Web Page has expired" message. This is likely the login screen.

If he presses F5, it looks like username and password are still hanging around
in POST variables and he gets logged back in.