title: Allow API access to anyone with sails policy
body: <p>I'm trying to use my SailsJS API with another node app and keep getting <code>403 Forbidden</code> response type.</p>
  
  <p>My action is <code>scale/create-weight</code> which creates a database record using the posted data.</p>
  
  <p>I addded the action to <code>config/policies.js</code> to allow access from not-logged-in users:</p>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-js lang-js prettyprint-override"><code>//config/policies.js
  
  module.exports.policies = {
  
    '*': 'is-logged-in',
  
    // Bypass the `is-logged-in` policy for:
    'entrance/*': true,
    'account/logout': true,
    'view-homepage-or-redirect': true,
    'deliver-contact-form-message': true,
    'scale/create-weight': true
  
  };</code></pre>
  </div>
  </div>
  </p>
  
  <p>And here is how I'm trying to access the API from a separate node app on the same computer:</p>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-js lang-js prettyprint-override"><code>const querystring = require('querystring')
  const http = require('http')
  
  const postData = querystring.stringify({
    'weight' : '10',
    'units' : 'ounces',
    'userId' : '5b8c16301cee97343513e184'
  });
  
  var options = {
      host: "localhost",
      port: 1337,
      path: "/api/v1/scale/create-weight",
      method: "POST",
      headers: {
            'Content-Type': 'application/x-www-form-urlencoded',
            'Content-Length': Buffer.byteLength(postData)
        }
  };
  
  
  const req = http.request(options, (res) =&gt; {
    console.log(`STATUS: ${res.statusCode}`);
    console.log(`HEADERS: ${JSON.stringify(res.headers)}`);
    res.setEncoding('utf8');
    res.on('data', (chunk) =&gt; {
      console.log(`BODY: ${chunk}`);
    });
    res.on('end', () =&gt; {
      console.log('No more data in response.');
    });
  });
  
  req.on('error', (e) =&gt; {
    console.error(`problem with request: ${e.message}`);
  });
  
  // write data to request body
  req.write(postData);
  req.end();</code></pre>
  </div>
  </div>
  </p>
  
  <p>There server is responding:</p>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>STATUS: 403
  HEADERS: {"x-powered-by":"Sails &lt;sailsjs.com&gt;","content-type":"text/plain; charset=utf-8","content-length":"9","etag":"W/\"9-PatfYBLj4Um1qTm5zrukoLhNyPU\"",
  "set-cookie":["sails.sid=s%3AonM7KWW6ohNoOPNiNjXy9NRFapolNavV.eZHy2P1o4WN1BvDbIWAZEsafG9RzaN1D6O%2FgaEjoLq0; Path=/; HttpOnly"],"date":"Sun, 09 Sep 2018 14:
  55:58 GMT","connection":"close"}
  BODY: Forbidde
  BODY: n
  No more data in response.</code></pre>
  </div>
  </div>
  </p>
  
  <p>What do I have to do to allow outside apps to use the API?</p>