Don't pull the security token from the environment or config when a caller supplies the access key and secret

The recently added support for pulling a security token from the environment or a config file allows tokens to be incorrectly associated with other credentials if a caller supplies an access key and secret.