The bug then is in your authentication code - logging off should actually log you off, not just navigate away from the page. You can use cache control headers to suggest to the browser that it should send a request to the server for pages that require authentication, thus placing your app back in control of whether or not to comply with the user's request. And obviously, you need to ask the browser to clear out any cookies or other client-side authentication information when the user logs off.
every night, i kneel at the foot of my bed and thank the Great Overseeing Politicians for protecting my freedoms by reducing their number, as if they were deer in a state park. -- Chris Losinger, Online Poker Players?
