policy files accept all permissions
use real security manager