Controller and policy implementation for express.js