It makes it easier to finely tune what parts of the default authentication stack
we want to use or not.

It also makes it possible for any cube to add its own policy in addition to the
others.

Related to #4985962