createAccount flow

+ get the policy from DB/mock
+ remove "secret Q" stuff