remove CONTENT op, fix dummy policy, add ensure_authorization