Pulled policy management logic into policies.js
Refactoring in router to make it clearer what's going on as far as exports.