POST works manually, so the policy is good.  must automate.