php login problems : Session not destroyed !

Hello, well i've got this little problem : i've set up a reserved zone for some members on a website.
The users log on with a simple form (login/pass) on index.php, are logged by login.php et are accessing the reserved zone
(intra/intra.php).
They can log out through a logout.php, accessible from the reserved intra/intra.php.

But here comes my problem : if the user #1 goes back to the log page index.php from the reserved zone,
without clicking on logout.php, (by typing the url on the address bar or something) and user #2
on the same host tries to log in with a new login/pass pair, the user #2 has user #1's settings (same session!).

How could I destroy the old session before registering a new one ?

Thanks for your help,
Eric.

Here's some code I use :

------------------------ index.php (the login form) ------------

<form method="POST" action="./login.php">
        <font size="2" face="Tahoma, Arial"><font color="#FFFFFF">Login:
        <input type="text" name="username" size="20">
        Passw:
        <input type="password" name="password" size="20">
        </font>
        <input type="submit" value="OK" name="login">
        </font>
      </form>

----------------------------------------------------------------


------------------------------------ login.php  
<?PHP

//check that the user is calling the page from the login form and not accessing it directly
//and redirect back to the login form if necessary

header("Cache-Control: no-cache, must-revalidate");

if (!isset($username) || !isset($password))
 {
  header( "Location: http://eirikur.planet-work.com/telecom/index.php" );
 }

//check that the form fields are not empty, and redirect back to the login page if they are

elseif (empty($username) || empty($password))
 {
  header( "Location: http://eirikur.planet-work.com/telecom/index.php" );
 }

else
 {
//convert the field values to simple variables

//add slashes to the username and md5() the password
$user = addslashes($_POST['username']);
$pass = md5($_POST['password']);

//set the database connection variables

$dbHost = "****************";
$dbUser = "*******";
$dbPass = "*******";
$dbDatabase = "*******";

//connet to the database

$db = @mysql_connect("$dbHost", "$dbUser", "$dbPass") or die ("Error connecting to database.");

@mysql_select_db("$dbDatabase", $db) or die ("Couldn't select the database.");

$result=@mysql_query("select * from Users where username='$user' AND password='$pass'", $db);

//check that at least one row was returned

$rowCheck = @mysql_num_rows($result);
if($rowCheck > 0)
  {
   while($row = @mysql_fetch_array($result))
     {
  //start the session and register a variable

  session_start();
  session_register('username');

  //successful login code will go here...
  //echo 'Success!';

  //we will redirect the user to the reserved zone
  header( "Location: generic.php?file=intra/intra.php" );
     }

  }
  else
  {

  //if nothing is returned by the query, unsuccessful login code goes here...

  echo 'Incorrect login name or password. Please try again.';
  }
}
?>