Fix user names in policy specs