Add instance based IAM role authentication

This change consolidates authentication decisions into a single new function.
First it will try using the passed in key/secret, then environment variables
and finally instance based IAM role authentication. Since instance based
IAM role authentication requires an additional token for signing the request,
the existing API has changed slightly since most use cases construct auth via
struct initialization. This will also allow for future changes such as
supporting credential files or STS AssumeRole.