query service: policy checks for URLs

Also added a falllback policy that denies
all access if the requested policy could not
be found.