Allow x-amz-security-token header when applicable