Fix typo in policy name
Fix popup policy's failure to detect popups

The request URI was lowercased, but then compared to a string with an uppercase
character
Popup policy should only be concerned with popups

The job of the popup policy is only to turn off the display of Glimpse inside
popups.  The superuser policy (which, perhaps, should be renamed now) can be in
charge of role-based security.  The Enable For All Users check doesn't need to
happen multiple times.