move html generation of policy to to_html method