Adding /<bucket>/ to the url to sign when in cloudfront

Cloudfront directs queries directed at /resource to S3 in the form /bucket/resource, S3 subsequently thinks the URL to compare signing against has form /bucket/resource rather than /resource, so when providing the URL for signing you need to prepend the bucket name.