There's probably a way to enumerate active auth tokens, including any
username info you've embedded. I'd probably try something more database and
event-oriented.
If you have a user table, you could keep TmsLastLogin and TmsLastLogoff
columns. At login, you set TmsLastLogin and null TmsLastLogoff. At manual
logoff, you set TmsLastLogoff. I'm guessing you can capture an event when
the auth token expires on the server site (?), and add some code to Global.
Then just query your db anytime you want to get a sense of who's probably
using the site.
Remember that you will never really know; it can be quite some time before
user inactivity results in an actual logoff.
