If an IP-only pass rule matches, set the no inspect flag for that flow. Bug #718.