The session validation function is an important feature that tracks the IP address of the session. However the current implementation confuses me.

Problem 1: Invalidated session is not logged out
When a session is invalidated, a redirect (via meta refresh) occurs and the user is brought back to the home page. However it does not sign the user out. The user continues to be able to do every thing.

Problem 2: Redirect through meta refresh causes the browser to cache the page
That is to say, the user will still experience the redirect on the same page unless he/she manually refreshes it. However since the redirect is automatically executed in 4 seconds, he/she has to refresh it within the short period of time.