add check_policy to POST and PUT