cloudfront canned policy urls not encoded - fixes #2227

The policies should be encoded no matter if they're canned or custom, right?