* introduced restful addresses (e.g. http://localhost:8080/policy/password)
* fixed: forward when done nothing
Merge remote-tracking branch 'origin/master' into master-real