specify operational token policies

[otakup0pe]

There are some cases in which it would be nice to specify the policies used by the operational token. The default is to use whatever policies the requesting token has associated with it. The default behavior should not change, but policies should be able to be specified as command line options.