Protect policy route with user auth

Added user authentication to the /policy route.