Exceptions to Web Protection Policies