Make the policy in the example valid.

Hear, hear; HTTP Headers do not map that beautifully to JSON, it seems :)