Why, in some cases, does a ProxySG send back a (2xx) response to a "CONNECT" request without opening a socket to the OCS first?