s3-auth: inline make_session_info functions into only callers