title: onRequestStart user authorisation does not work correctly coldfusion
body: <p>Im my Application.cfc I am trying to use the <code>onRequestStart()</code> function to protect my pages as such:</p>
  
  <pre><code>&lt;cffunction name="onRequestStart" access="public" returntype="boolean"&gt;
    &lt;cfargument type="String" name="TargetPage" required="true"/&gt;
  
    &lt;!--- Define which pages don't need protection ---&gt;
    &lt;cfset APPLICATION.AllowedPages = "/index.cfm, /register.cfm"&gt;
  
    &lt;!--- Create an instance of the page-protect.cfc ---&gt;
    &lt;cfset APPLICATION.PageProtect = CreateObject("component", "page-protect")&gt;
  
    &lt;!--- check if the current page is an allowed page ---&gt;
    &lt;cfif #ListFindNoCase(APPLICATION.AllowedPages, ARGUMENTS.TargetPage)# EQ 0&gt;
    &lt;!--- if its not an allowed page, then protect it ---&gt;
    &lt;cfscript&gt;
    APPLICATION.PageProtect.PageProtectBasic(argumentcollection = session); 
    &lt;/cfscript&gt;
    &lt;/cfif&gt;
  
  &lt;cfreturn true&gt;
  &lt;/cffunction&gt;
  </code></pre>
  
  <p>This code works (kind of as you will see later). Page-protect.cfc is very simple and does this:</p>
  
  <pre><code>&lt;cfcomponent displayname="page-protect" output="false"&gt;
  &lt;cffunction name="PageProtectBasic" output="no"&gt;
    &lt;cfif NOT structKeyExists (SESSION, 'Auth')&gt;
      &lt;cflocation url="/index.cfm" addtoken="no"&gt;
    &lt;/cfif&gt;
  &lt;/cffunction&gt;
  &lt;/cfcomponent&gt;
  </code></pre>
  
  <p>So if the <code>Auth</code> structure within the <code>SESSION</code> scope does not exist, then this user is not logged in and should be taken back the homepage. A logout method in a different file deletes the Auth structure from SESSION and also clears the SESSION scope (if definitely does this I have tested it).  </p>
  
  <p>The <code>onRequestStart()</code> page protection works initially but I have noticed that when I press the back button on my browser it will show the previous page that I just logged out of. This should be a protected page and not display but I guess its a browser cache so not a problem. However the problem is that if I click on a link in this page it SHOULD not allow it and send the user back to home page (because the SESSION.Auth structure does not exist and SESSION has been cleared). But it does not send the user back to the homepage anymore, it just shows a ColdFusion error page stating that "Element AUTH.{element_name} is undefined in SESSION". </p>
  
  <p>So for some reason its not going back to the homepage despite the user not being logged in, and instead is trying to load the protected page and then falling over because a variable within the SESSION.AUTH structure does not exist. I simply don't understand what I'm doing wrong. Please help!</p>