Is this secure?

1. Login. Logout. Hit back, and the browser still shows the "Logout" button and the previous info. Should a browser refresh/expiration be required to clear out the back?

2. I can navigate straight to all the pages in the example. None of "error" out for authorization denied.

>> 1. Login. Logout. Hit back, and the browser still shows the "Logout" button and the previous info. Should a browser refresh/expiration be required to clear out the back?

What kind of authenciation mode did you use ? I don't know how you "get" it , but i test it with my browser , it work successfully .
And "Logout" button , it's should be "Logout" link . Did you combine it with your source ?

SecureLogin just handle login/logout action , and provide a callback function for you to check login information . This's why you don't get a deny message .

If you still have trouble , you can email to me quocbao.coder@gmail.com