actually I think it has to be in 

JAVA_HOME/jre/lib/security/java.policy

and not in 

JAVA_HOME/lib/security/java.policy

there should be one in 

program files/javasoft/jre/1.3/lib/security too and it depends on which vm
you use as to which one will have affect you application.