make key optional on read policy

supports generating a policy for buckets too.