s3:auth: only call secrets_fetch_domain_sid() once in finalize_local_nt_token()