Add ability to set policies on REST routes