auth-cfg: Prefer merged rules over existing ones when moving them