added policies so unauthenticated users do not get flash updates