* now providing entire response
* now also possible to evaluate a policy without Closure to get the response object directly