version 1.0.6: strip out x-amz-security-token when generating s3 urls