Include X-Amz-Security-Token if available

Otherwise presigned urls won't work for temporary credentials.

cc @danielgtaylor