Change EnvCreds to resemble SDKs.

Instead of returning early if a security token is provided, always check
for the access key ID and secret access key. This is essentially the
same behavior as the SDKs.