s3: fix signed URLs with temp tokens

When using temporary credentials (e.g. IAM roles) it's necessary to include the token in the URL when signing.