Allow CloudFront API calls using IAM roles

When picking up credentials from an IAM instance role,
need to add header x-amz-security-token to the request.
Otherwise you get InvalidClientTokenId.