no policy uri, so how does the browser get the policy now?