allow only virtual server OR floating VIP

unless I misunderstand how this is supposed to work...