Don't break the back button. The back button can take you back past your own page to pages visited before, so breaking it annoys people.

You should probably do the cookie checking through Perl, not Javascript. That way, when your user hits the back button they either get a cached version of the page (they were authorized to view it in the first place), or they get a "You have been logged out" message. If you're really worried about cached pages like that, you can add a custom header that says the page expired sometime in the past. (1969 would be a good year.)