try to invalidate the session  once the user  is attempts to log out; followed by removing any attribute of that session. utilize invalidate and removeAttribute of the session instance.

also you might want to consider a scope for the objects involved in the session or transactions. in that case when an old page  with old data has been visited (by pressing on back button), the content will not be shown as the session / objects instances have already been invalidated as part of logging out.