Make frameup work with STS credentials

This just handles the x-amz-security-token if found in params passed to the form.