s3: replace AuthEnv with EnvAuth