you can solve your problem adding a javascript in your logout button  or
link.

make a redirect to your login.jsp page  then add a script
location.replace("login.jsp").

ex.
function doLogout()
{
window.location = "login.jsp";
window.replace("login.jps");
}

but you still have a problem, user could call a page throught the url, so don´t
forget to destroy your session and configure your login
page in yout web.xml when session is destroyed.