What changes within the packet header when using the always_verify(yes) policy rule?