Document more thoroughly; add sample security policy and make tests work with security policy.