policy command enhancements

[williamcroberts]

in policy_secret, for example, the nonce and the expiration are required. We can make a nonce of None get the current nonce on the digest? None for the expiration could mean to max it out?

This is just thoughts off the top of my head to make the API easier, but it may not be right or the best way.

[whooo]

Is the nonce really required?
For expiration, we could take the string "max" and then just set the expiration to the max value.
It would make the code more readable.