Fix two excessively aggressive policy checks

Summary:

• Some applications need public access regardless of policy configuration.
• The file data endpoint should ignore policies.