Assumed sessions

Every time someone calls AssumeRole, a short-lived session is issued. You see every active one here — and can revoke one if you suspect credential leak.