initial POC for accessing protected S3 objects working
next steps: cleanup, tests, refactor