Audit: allow to expect specific substring with http audit