added express-jwt and small fixes to policies