add comment about stupid aws session_token/security_token