Allow rules bypass SPF/DMARC checks

A global allow on microsoft.com would let any spammer impersonating Microsoft through. Allow rules currently skip ALL scoring including authentication. Need to restrict allow rules to only bypass content scoring, not auth.