policy authorizer handles hierarchical URIs
1) checks first if there is a policy for the entire URI , returns the result if found
2) if not, checks the policy for the parent URI , returns if the result is found
3) repeat until the URI is stripped to the top
no yaml support anymore