s3-rpcclient: use is_valid_policy_hnd before closing handles.