anchor.diff:                                         RequestId, StringToSign, Req0, Context)
       end.
   
  --spec is_expired(binary()) -> boolean().
  -is_expired(Expires) ->
  +-spec expire_diff(undefined | binary()) -> integer().
  +expire_diff(undefined) -> 1;
  +expire_diff(Expires) ->
       Now = calendar:datetime_to_gregorian_seconds(erlang:universaltime()),
  -    bksw_util:to_integer(Expires) < (Now - ?SECONDS_AT_EPOCH).
  +    bksw_util:to_integer(Expires) - (Now - ?SECONDS_AT_EPOCH).
   
   %% get_bucket([Bucket, _, _]) ->
   %%     Bucket.
  
positive.code:     Path  = wrq:path(Req0),
      AccessKey = bksw_conf:access_key_id(Context),
      SecretKey = bksw_conf:secret_access_key(Context),
      case make_signed_url_authorization(SecretKey,
                                         Method,
                                         Path,
                                         Expires,
                                         Headers) of
          {StringToSign, Signature} ->
              case is_expired(Expires) of
                  true ->
                      ?LOG_DEBUG("req_id=~p expired signature (~p) for ~p",
                                 [ReqId, Expires, Path]),
  
negative.code:                           erlang:iolist_to_binary(Signature) ==
                                erlang:iolist_to_binary(IncomingSignature)) of
                          true ->
                              MaxAge = "max-age=" ++ integer_to_list(ExpireDiff),
                              Req1 = wrq:set_resp_header("Cache-Control", MaxAge, Req0),
                              {true, Req1, Context};
                          false ->
                              ?LOG_DEBUG("req_id=~p signing error for ~p", [ReqId, Path]),
                              encode_sign_error_response(AWSAccessKeyId, IncomingSignature, RequestId,
  