Fix two excessively aggressive policy checks

Summary:

  - Some applications need public access regardless of policy configuration.
  - The file data endpoint should ignore policies.