Tighten up HA policy validation.
Merge bug25555 into stable