Add policy instead of user to a NotAuthorizedError