Externalized policy

This is the externalized policy code that we had talked about a while ago.

Changes related to the password example get "replaced" by the base browser policy in a later commit. If you'd rather, I can squash this into the base browser policy commits and send a PR for that.