That is the tricky part, it has to be discarded as 
security-domain=*/authentication=classic/login-module=module:add is redirected one level up, and now becomes add(or write-attribute) for security-domain=*/authentication=classic