Consent_token used by rack-policy is always white-listed
Policy can be unset, accepted, rejected