Create separate policies for API access and session login