nit: "... in all routes underneath without configured mirror policies."     Routes that already have a mirror policy left, won't get the policies from their virtual host or their route configuration.     We should also a unit test for this.  