ECMS-5016 add XSSValidator and correct the way to get instance of Policy