Hi,
You're right: the sessionScope isn't cleared when a user logs out. I've worked around this by storing the current user's username in the sessionScope and checking if the current user has changed. If it has, the sessionScope is cleared and refilled.
Mark