When does an ICAP REQMOD request 'fail_open'?