change: spell out the AWS session token in the token hint and the docs