},
	ErrMalformedExpires: {
		Code:           "AuthorizationQueryParametersError",
		Description:    "X-Amz-Expires should be a number",
		HTTPStatusCode: http.StatusBadRequest,
	},
	ErrNegativeExpires: {
		Code:           "AuthorizationQueryParametersError",
		Description:    "X-Amz-Expires must be non-negative",
		HTTPStatusCode: http.StatusBadRequest,
	},
	ErrAuthHeaderEmpty: {

	d := UTCNow()
	// Find epoch expires when the request will expire.
	epochExpires := d.Unix() + expires

	// Add expires header if not present.
	expiresStr := req.Header.Get("Expires")
	if expiresStr == "" {
		expiresStr = strconv.FormatInt(epochExpires, 10)
		req.Header.Set("Expires", expiresStr)
	}

	if lc == nil && opts.Expiration.Expire {
		if opts.VersionID != "" {
			return objInfo, VersionNotFound{
				Bucket:    bucket,
				Object:    object,
				VersionID: opts.VersionID,
			}
		}
		return objInfo, ObjectNotFound{
			Bucket: bucket,
			Object: object,
		}
	}

	if opts.DeletePrefix {
		if opts.Expiration.Expire {

				took := time.Since(refreshStart).Seconds()
				if took > maxDurationSecondsForLog {
					// Log if we took a lot of time to load.
					logger.Info("IAM refresh took %.2fs", took)
				}
			}

			// Purge expired STS credentials.
			purgeStart := time.Now()
			if err := sys.store.PurgeExpiredSTS(ctx); err != nil {
				iamLogIf(ctx, fmt.Errorf("Failure in periodic STS purge for IAM (took %.2fs): %v", time.Since(purgeStart).Seconds(), err))

		Client:      s.TestSuiteCommon.client,
		STSEndpoint: s.endPoint,
		GetWebIDTokenExpiry: func() (*cr.WebIdentityToken, error) {
			return &cr.WebIdentityToken{
				Token:  token,
				Expiry: 900,
			}, nil
		},
	}

	// Create policy - with name as one of the groups in OpenID the user is
	// a member of.
	policy := "projecta"
	policyTmpl := `{
 "Version": "2012-10-17",

	for _, v := range policy.DefaultPolicies {
		if _, ok := policies[v.Name]; !ok {
			policies[v.Name] = defaultPolicyDoc(v.Definition)
		}
	}
}

// PurgeExpiredSTS - purges expired STS credentials.
func (store *IAMStoreSys) PurgeExpiredSTS(ctx context.Context) error {
	iamOS, ok := store.IAMStorageAPI.(*IAMObjectStore)
	if !ok {
		// No purging is done for non-object storage.
		return nil
	}

			var sz int64
			objDeleted, sz = item.applyActions(ctx, objAPI, oi, &sizeS)
			done()

			// DeleteAllVersionsAction: The object and all its
			// versions are expired and
			// doesn't contribute toward data usage.
			if objDeleted {
				break
			}
			actualSz, err := oi.GetActualSize()
			if err != nil {
				continue
			}

			if oi.DeleteMarker {

			z.ContentEncoding, bts, err = msgp.ReadStringBytes(bts)
			if err != nil {
				err = msgp.WrapError(err, "ContentEncoding")
				return
			}
		case "Expires":
			z.Expires, bts, err = msgp.ReadTimeBytes(bts)
			if err != nil {
				err = msgp.WrapError(err, "Expires")
				return
			}
		case "CacheControl":
			z.CacheControl, bts, err = msgp.ReadStringBytes(bts)
			if err != nil {

					Key:          objInfo.Name,
					Bucket:       objInfo.Bucket,
					ETag:         getDecryptedETag(formValues, objInfo, false),
					ModTime:      objInfo.ModTime,
					Expires:      objInfo.Expires.UTC().Format(http.TimeFormat),
					CacheControl: objInfo.CacheControl,
					Metadata:     cleanReservedKeys(objInfo.UserDefined),
					Size:         asize,
				})

	Started   time.Time            `yaml:"-" json:"started"`
	Replicate *BatchJobReplicateV1 `yaml:"replicate" json:"replicate"`
	KeyRotate *BatchJobKeyRotateV1 `yaml:"keyrotate" json:"keyrotate"`
	Expire    *BatchJobExpire      `yaml:"expire" json:"expire"`
	ctx       context.Context      `msg:"-"`
}

func notifyEndpoint(ctx context.Context, ri *batchJobInfo, endpoint, token string) error {
	if endpoint == "" {
		return nil
	}