moved auth_method to policy