Which events force the Symantec Web Gateway (SWG) to switch to bypass mode?