Security Policy file should be an example

Currently there is a security policy file which has been tuned for a somewhat specific configuration. As of 1.4, we've designed it to fail open, such that no file means open security policy. We should change the default policy file to an example file, this way we can be more confident the system works out of the box. Then users can go about renaming to begin using the security policy should they chose to do so.