There is no single piece of advice because various applications have different requirements.
Credentials are most often handled in the form of tokens. You authenticate yourself to a server, it returns a token, you cache the token and pass it to each system you're dealing with. The token could be of any form: a cookie, a session ID, a Kerberos ticket, an NTLM token, or whatever. The client stores it in a local cache, and presents it every time it uses a service that needs to know your credentials.
So the next thing you (as a client) want to do is to access some service. You present the token, the service calls the authenticating server, figures out your groups/roles/authority, learns the expiration time of your token, and grants you access. The service then simply caches your token and all those attributes, then compares every incoming request to see if you're still using the same token. It doesn't re-validate your token until the expiration time indicated by the authenticating server.
In a service intensive app, you would have performance problems if you asked the authenticating server to authenticate every single service request. (Consider that a typical Windows app might present the security token to a dozen different Win32 API calls before even showing you the "welcome" screen!) Therefore, for those systems caching the token at the service level is critical.
But as long as the cached copy is used, it's not being re-checked to see if it's been subsequently invalidated. You might sign on to Facebook in a panic because you remembered you left yourself logged in at the coffee shop and set the flag, but you'll have to wait for the next cache expiration before it takes effect.
In a high security application, you may turn the expiration time way down. I suppose it's possible that you could require that your services perform no caching of credential attributes, and that all tokens are always sent to the authenticating server. In a low security application (perhaps a blog) you would probably place more value on convenience and performance.
From your description, it sounds like Facebook probably has custom integration between their session management and their credential systems. If you tick the "log me out" button, it may post a notification to the session management system to immediately invalidate all sessions associated with your account. Which would be clever and hyper-fast, but I don't think most authenticating systems support pub/sub notifications like that. I am unaware of any such callback service offered by Kerberos, but I think the next version of Apache Directory Services is going to offer "triggers", which sound like they might be used for the same purpose.