feat(php/s3/s3demo.php): verify policy & REST header strings before signing