s3:auth: only create_local_token() should add S-1-22-X-Y sids