check whether query_auth is true before adding x-amz-security-token when run using an IAM role

raised in ticket #2043 
pull request #2044 was stalled on a unit test, so I have written a unit test for it

Failing
https://travis-ci.org/heywbj/boto/builds/35885578
Passing:
https://travis-ci.org/heywbj/boto/builds/35885865