add policies for authentication