Add support for "Assume role with saml" in AWS

Support for AssumeRoleWithSAML:
http://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html

This one is a bit tricky as everything tends to be signed in fog, this STS command needs to work without being signed.

To do that the usual `:aws_access_key_id` and `:aws_secret_access_key` need to be optional.
The access key is needed when doing classic requests. If the signer hasn't been set (because the key_id or the secret haven't been provided), fail every request early.