check for attribute existance in policies

one point to discuss : for filter_username, if the request doesn't contain a username, should we reject or noop ?