move policies to the root of the webserver