allowDirect -> failDirect
get rid of the direct directive, just do failPage
No, get rid of failPage instead.

A well-run proxy shouldn't go down, and if it's having
problems, it should present a 5xx page to the user, so
failPage is duplication of effort.
Precedence between forReferers and alwaysDirect
trailing spaces
update XML