Hmm, are you sure that the token also needs to be taken into account when calculating the signature?

From the documentation (http://docs.aws.amazon.com/STS/latest/UsingSTS/using-temp-creds.html):

"Include the IAM session token that is part of the temporary security credentials. You include the session token as an authorization header to the request—for example, as the X-Amz-Security-Token header. (The session token is not part of the information that's used to create the signature.)"