It can be used to "bolt-on" policy checking into Servant API routes.

Tests were written with a very flat module hierarchy which made them
a bit confusing to navigate. This commit moves everything under a common
`Test.*` hierarchy.