Provider fixes

Vagrant spins up in the resource dir without templating (for now), AWS
uses a shared (user-specific) private bucket for payloads, with the
expiring URL for instance access