Blazor CSR Cookie with Policy-Based Authorization