Fix policies don't protect `findOne` action

Lowercase `findOne` for blueprint action look-up which is case insensitive