configurable policyurl and cert-level usage, more quoting