CLC-3194 Improve design: UserAuth has-a policy, instead of the reverse