invalidate s3 tokens, and use env vars