Offlioad is in the wrong section.

[beave]

Offload is between content/pcre and Bluedot. This leads to unexpected results.

For example, offload is call when the basics of the signature are called (content/pcre), handed to Offload() and then Bluedot/GeoIP is evaluated. This is incorrect. Offiload() should be call after GeoIP and Bluedot.