Forcing destruction of httpSession variables on logout
Currently when you manually click the logout button in Craft, it will destroy your authenticated session information (to be logged into the control panel), but keep your existing PHP session (represented by the CraftSessionId cookie) so anything stored in PHP's session will remain.

If that's not the behavior you're looking for, you can make a feature request to expose this behavior via a config setting and/or write a simple plugin that listens for the userSession.onLogout event and manually destroy PHP session.