Refactor Credential management, add AWS STS

@boldfield and @alex may be especially interested, but more reviewers are most helpful.

I think this would also allow for more graceful adaptation of role-based IAM that people have been asking for for...uh....years.