fixes #5

should now be easier to test AbstractPolicy, also refined access
modifiers for core services