That's an odd requirement. Either way it wouldn't be a pages.xml issue, it would be something funky you'd do in your authenticator. For instance a primitive approach would be to have authenticator put an "IN_USE" marker in application scope, which is removed on logout and session unbinding.