I have modified the system to overwrite the cookie with a new value 'loggedout' rather than try to erase it.

I think you missed the point then. The browser doesn't have to respect that request either. And if it doesn't, are you trusting that old cookie that says that the user is still logged in? {sigh}

Please read the article again. Do not trust anything from the browser. Use a cookie only to distinguish this browser from that browser. Do not use cookies for anything regarding state.

-- Randal L. Schwartz, Perl hacker
Be sure to read my standard disclaimer if this is a reply.