The second problem, related to the back button, occurs because the browser re-post the old values to the login page, causing the user to re-authenticate. I read an article (don't remember where) that suggests the addition of a third page in the "login" sequence, to avoid this "feature" of some browsers...