sts.assume_role may use SecurityToken in request for MultiFactorAuth