s3:auth_server: make use of cli_state_server_challenge()