s3: fix signed URLs with temp tokens