Don't pull the security token from the environment or config
when a caller supplies the access key and secret
Merge pull request #2123 from jimbrowne/security-token-env-ignore

Don't pull the security token from the environment or config when a caller supplies the access key and secret. Fixes #2123.