Have a cookie to identify whether someone is authenticated and then in your session end (global.asa?) code, clear the cookie value. Ensure that on each page you check for the cookies existence.