Correct policy order to fix overrides.

This commit fixes the order of policies in `config/policies.js`. Policies for `*` should always be listed first; you should override that configuration with more specific policy requirements later.