s3-auth: remove "security=server" (depricated since 3.6)