read pass-policy from config file

related to https://github.com/OhadR/oAuth2-sample/issues/48