Remove 'GenerateResponse' from VerifyAccesstoken Policy, so that the flow will reach the target instead of terminating at the policy itself