Fix thinko

The property is named aws_session_token, not just session_token.
Change AWS_SESSION_TOKEN to AWS_SECURITY_TOKEN

After discussing with AWS on guidance on the nomenclature here and
getting a wishy-washy result, choose to call this variable
'AWS_SECURITY_TOKEN' after all.

Rationale:

1. "session tokens" are a distinct from "federation tokens"

   They have their own expiry rules and API endpoints in STS.

2. However, as this is intended to be used, a "session token" will
   probably never be placed in AWS_SESSION_TOKEN: instead a
   "federation token" is used.

   That is problematic and misleading because federation tokens have
   their own, distinct semantics for some kinds of operations...but
   none of which WAL-E cares about.

3. The AWS staff recommended the name 'AWS_FEDERATION_TOKEN', but at
   the time of writing Google cannot find a single match on the web
   for this.

   This does show that some of the staff there view the two types of
   token as quite distinct when one is really zoomed in.

   But, libraries (boto, fog) are frequently treating the token as an
   opaque value in usage for signing requests.

   The hopes of adhering to idiom or convention are dashed here.

4. From these things, interpret that both "session tokens" and
   "federation tokens" are special cases of "security tokens",
   because:

   a) STS is the "security token service"

   b) Both slot into the API for signing the same way

5. As WAL-E does utilize anything about the semantics unique to any
   kind of token here, try to communicate the opacity of the token by
   this generic name.