Another solution is, use no cache in all of your pages. It forces the browser to reload user.apsx instead of reading from cache.
First, use these code in your header:
<meta http-equiv="Pragma" content="no-cache">
<meta http-equiv="Cache-Control" content="no-cache">
Secondly, you must ensure that your user.aspx doesn't allow to open directly without a valid session.