- one using a hostname match, low rule priority, requiring authentication
- the second one uses a hostname and ClientIp match, high rule priority, bypassing authentication