support for env var and aws temporary credentials

this enables both support for specifying credentials using env vars as well as for temporary aws credentials.

the behavior is:

* env vars always override the config file
* you can mix and match env vars and config file values
* use `AWS_SESSION_TOKEN` (env var) or `session_token` in the config file to leverage temporary credentials
* if either `AWS_SESSION_TOKEN` or `session_token` are found, then it assumes that temporary credentials should be used (and will therefore include the session token in calls to aws)

does this behavior make sense from a user perspective? what sucks?


@rickmendes @brettweavnet-intuit didn't we have some spec helper code somewhere to clean this up? i can't seem to find it