I'm not clear why this (for example security-domain=*/authentication=classic) add operation gets discarded?