change session token to security (per aws convetion)