Fix signature problems with IAM Roles and S3.

If using an IAM Role with temporary credentials we need to include the
X-Amz-Security-Token header otherwise the AWS keys are unrecognized.

Also when using signed_url() we need to include UNSIGNED-PAYLOAD when
performing authentication via query string passed parameters.  Otherwise
a signature does not match error is returned.

As documented at:

http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-query-string-auth.html