EKU match not required if URI matches