s3:auth:check_sam_security: fix a leading tab/ws mixup