Order of PathCheck directives not working?

Question

Hello,
I have an odd problem with the execution order of the PathCheck directives in obj.conf file. I understand it that these are executed in order in which they appear in the file.
We're using the SmartFilter 4.2 content filter.
Basically the way I understand this should work is that the check-acl PathCheck directive should execute first (for the default ACL), presenting the authentication prompt, and then after that the sf-url-check PathCheck directive should execute at which point SmartFilter will then decide if it'll allow the page to be loaded or it'll return it's denied access page.
What's happening in actuality though is that if the page is one which SmartFilter would block, the proxy authentication prompt does not appear. If the page is one which SmartFilter would allow, the proxy authentication prompt does appear. I've swapped order of PathCheck's around and it doesn't change things.
If I replace sf-url-check with the default url-check everything works fine.
It's as though regardless of the order of PathCheck directives the SmartFilter one executes first and if it doesn't like the URL it just blocks it skipping the proxy authentication PathCheck directive, but if SmartFilter does like the URL it allows the proxy authentication PathCheck directive to execute.
I'm confused as I thought the order of the PathCheck directives executes in order of their appearance, but someone perhaps SmartFilter is overriding this.
This is in v4.04 of the proxy as SmartFilter presently doesn't support v4.05.
Any thoughts?
Here's the default object code from obj.conf:
<Object name="default">
PathCheck fn="check-acl" acl="default"
PathCheck fn="sf-url-check"
ObjectType fn="cache-enable" query-maxlen="10" log-report="off"
ObjectType fn="cache-setting" lm-factor="0.10" max-uncheck="7200"
Service fn="proxy-retrieve" method="*"
</Object>
Here's the default ACL from generated.proxy-testing.acl:
acl "default";
authenticate (user,group) {
database = "default";
method = "basic";
prompt = "Internet Access";
deny (all)
(user = "anyone");
allow absolute (all)
(group = "ApprovedInetUsers");
-----

Answer 1

Hello,
Does anyone have any thoughts as to what is causing this?
Thank you.