URL category-based flows with 'discard' or 'never-admit' policy