This code modifies `POST` request type, each of them will need to specify an array of needed policies, that will be checked before accessing endpoint. Empty array means that this endpoint doesn't need acknowledgment or information about missing will be attached to response later on. Looks like other handlers, e.g. for GET requests doesn't need to check for policies, there is on need to complicate this because with this change will still make user unable to use app without accepting what's needed.