How to expire the session immediately?

Assuming you're using Forms Authentication, you should do this when the user logs out:

' Imports System.Web.Security
Session.Abandon()
FormsAuthentication.SignOut()
Response.Redirect("~/login.aspx")

In order to prevent the user from using the Back button at that point, you must configure IIS to expire content immediately: http://www.microsoft.com/windows2000/en/server/IIs/htm/core/iipswwws.htm

I know of no way to make the Back button take the user to the login page unless that's the page he came from.