updated config/policies.js to allow user creation without auth policy