s4-drs: better debug info when security checks fail