- mfa token only needs to be provided once per source rather than once
  per profile by adding `mfa_serial = <arn>` to the root source profile
- allows assume role chains (e.g. roleB <- roleA <- master)

The flag defaults to false but will be switched to true if the given
profile does not have a SourceProfile, since a session token cannot be
used to create a sign in url.

SessionDuration must be omitted from the request to get the sign in
token if the credentials were from an assumed role that used a session.