changed password_policy_callback to user_policy_callback

user_policy_callback takes all json data as an arg, and must return it (potentially modified) or raise an exception