The only solution I've found for this is to set explicit expirations on your pages. If you force the page to always be expired, the browser should always try to request it from the server again. When the user logs out, it will clear whatever mechanism is tracking them (forms auth ticket cookie, session data, etc). Then the re-request to the server will see they are not authenticated any more and they'll be forced back to the login page (or at least to a "you aren't logged in" notice).
-Peter
peterlanoie.blog