support AWS_SECURITY_TOKEN if present in env