this worked for me, in drupal 7 (php) whenever a user logs out, he can press the back button and able to visit the privileged pages. If a page is refreshed, then he is routed to a front page where he can't do anything.

 <?php //refresh the page after log-out and back button if (!user_is_logged_in()) { print '<input type="hidden" id="refreshed" value="no"> <script type="text/javascript"> onload=function(){ var e=document.getElementById("refreshed"); if(e.value=="no")e.value="yes"; else{e.value="no";location.reload();} } </script>'; } ?> 

somebody posted here: thanks i hope it help you too.