I think I have the login page working properly, but there is definitely a WEIRD issue on logout!
Click the logout link, all sessions are apparently killed. However, going 'back' in the browser, you can still access the page.
So I created a page to show all session values; logout, then go to this page and it shows there are none - however, the 'back' button still gives access. \moreover, if i go to the login page, the links are still displayed to the admin areas - these should only be displayed if Session values are available.