support AWS_SESSION_TOKEN if present in env