I think a force-refresh should be the way to go here.
Are the sessions updated for the affected user right away? Hypothetical situation: Admin is on rampage, I revoke rights and I expect him to be unable to do anything after I clicked the button. If he still can do anything he wants, there’s not much use in revoking his rights, isn’t it?