support for env var and aws temporary credentials

this enables both support for specifying credentials using env vars as well as for temporary aws credentials.

the behavior is:

* env vars always override the config file
* you can mix and match env vars and config file values
* use `AWS_SECURITY_TOKEN` (env var) or `security_token` in the config file to leverage temporary credentials
* if either `AWS_SECURITY_TOKEN` or `security_token` are found, then it assumes that temporary credentials should be used (and will therefore include the security token in calls to aws)

does this behavior make sense from a user perspective? what sucks?