code: func suffix(pathToBucket string, bucketPrefix string) (string, error) {
  	full, err := url.QueryUnescape(pathToBucket)
  	if err != nil {
  		return "", trace.Wrap(err)
  	}
  	prefix, err := url.QueryUnescape(bucketPrefix)
  	if err != nil {
  		return "", trace.Wrap(err)
  	}
  
  	remain := full[len(prefix)+1:]
  	if remain == "" {
  		return "", trace.BadParameter("unable to split %v", remain)
  	}
  
  	vals := strings.Split(remain, string(filepath.Separator))
  	if len(vals) == 0 {
  		return "", trace.BadParameter("unable to split %v", remain)
  	}
  
  	return vals[0], nil
  }
docs: // suffix returns the first bucket after where pathToBucket and bucketPrefix
  // differ.  For example, if pathToBucket is "/roles/admin/params" and
  // bucketPrefix is "/roles", then "admin" is returned.