Don't require a policy (or that canI is called) if the server file doesn't have a load function.

[tombroomfield]

Given a form with a page, and a +server file that only exports the actions object, we probably don't need a policy to be enforced.