How are sessions intended to work?

RedHat 5.2
Apache 1.3.9
PHP RC2

I have been trying to wrap my mind around this session stuff for several days
now and I am having some difficulty.

I am trying to use the session stuff to keep track of when a user logs into a
section of a web site and then logs out.  But I want to be able to prevent them
from using the back button to access the area once they have logged out.  Up to
this point I have not been able to accomplish this.

I have three pages; login.php, menu.php, and logout.php.  login.php has a form
on it which allows the user to enter a login id and password.  When the user
clicks on the submit button it calls menu.php (action="/menu.php").

login.php has a session_start(); at the very top of the page and then it
registers some variables using session_register();.

menu.php has a session_start() at the very top of the page and then it checks to
see if one of the variables has been registered using session_is_registered().
If it is not registered the login.php page is displayed, otherwise the menu page
is displayed.  My thinking here is that the only way login_id should be
registered with the session is if login.php has been called since it is the only
page that registers the variables.

logout.php has the session_start() at the very top and then immediately calls
session_destroy() to clear out all the session information, at least that is
what I would like it to do.

I can log in, go to the menu.php page, and log out.  Then if I click on the back
button in my browser and re-post the data (it was originally called from a form)
the menu.php page will be displayed again.  Now, to my thinking the
session_destroy() in the logout.php page should have unregistered the variables
associated with the session.  If so, why doesn't the check in the menu.php page
see that the variable is not registered and then display the login page?

While trying to debug this I was watching the existence of the session file in
my /tmp directory.  When this file is there and when it gets deleted is rather
interesting, but what I did notice the one time was that when I logged in the
file appeared and when I logged out the file disappeared.  Then whe I hit the
back button the same file re-appeard!  If the session has been destroyed and the
file has been deleted why would hitting the back button cause the same, exact
file to be re-created?

Of course, sitting here writing this I have said "Why don't I just un-register
the variable in the logout.php page?".  I imagine that would probably solve my
problem  but I still am confused about what session_destroy() should be doing.

TIA
Tim McGinnis