fix category matching in firewall sso