add and sign x-ams-security-token header when Token is given