s3-waf: use new variable expansion feature