s3:auth_server: make use of cli_state_security_mode()