The web protect/.htaccess feature is quite secure.
However, once a browser authenticates, that browser can visit any number of sites and return to the authenticated site without having to re-authenticate, so long as it has not been closed.
So, a logout would require closing the browser.
A snippet of javascript like the following could work for most visitors.
Code:
<form>
<input type=button onClick='window.opener=self;window.close()' value='Logout'>
</form>