TMTOWTDI. If you're making a session ID already, then you're almost there. You need to take it one step further. Here's the concept:
Make a session ID (*Done already*)
Record that ID in a file with the IP address, and time stamp (EPOCH or something.)
When the user goes to a new page, make sure to send along the current session ID (Hidden field or populate the URL location bar... whatever)
Check that session ID against the session ID, IP address etc. in the file that you logged to make sure that they exist. If they don't exist, then make them log in.
Make a new session ID.
Delete their old session ID and record their new session ID.
If you want to allow for just one back button, then simply record the past "two session id's." This is not necessarily elegant, but it gets the job done. (Actually the credit to this method belongs to fenonn.)