s3:rpcclient: give errors and clean up correctly after failing to obtain secret