well u could logout by using these methods
1) using the session.invalidate();
2) restricting the user from using the login details (when using the back button) by refreshing the page.
3) Using the sessionAccessTime.........

The first method does get you out of the session ............
provided you have used the session='true' [for jsp pages]
or HttpSession s=request.getSession(true) [in servlet this code works in the jsp in <% %>tag]
in the first page and using false in the rest of the pages as it wont create the new sessions..................

but this method is ineffective as the browser has a back button.................

if you want to know more about doing a proper logout you can write to me