add in ability to allow anonymous bucket object reads, mainly for web use
modify ref patterns to restrict S3 bucket access to just the app tier, and hence a single bucket policy.