[AWS|Storage] fixed signed urls when using session tokens

the session token needs to be added to the signature as a header
(as well as being included in the query string)