iRule interpretation assistance

Hi Dev Central. I need some assistance interpreting the following iRule, especially the first line. My interpretation is that if the HTTP path contains any of the following: /, /index.jsp, /startpage, /sap/admin, /sap/admin* AND the client IP address is NOT in the All-Internal_dg Data Group List, then the request is REJECTED. Is this correct?

What is bothering me is the very first line with the "/". This would mean that any path would be rejected if the request isnt coming from an IP in the All-Internal_dg Data Group List right? I ask because this service is still accessible from IPs that are not in the All-Internal_dg Data Group List. So I am wondering how some paths are still working for clients that are not in the All-Internal_dg Data Group.

Thanks for any help you can lend. 

switch -glob [HTTP::path]  {

    "/" {
      # log 10.x.x.58 local0. "In root client ip is [IP::client_addr]"
      if { not [matchclass [IP::client_addr] equals All-Internal_dg] } {
        reject
      }
      HTTP::redirect https://[getfield [HTTP::host] ":" 1 ]/startPage
    }

    "/index.jsp" {
      # log 10..x.x.58 local0. "In index.jsp client ip is [IP::client_addr]"
      if { not [matchclass [IP::client_addr] equals All-Internal_dg] } {
        reject
      }
      HTTP::redirect https://[getfield [HTTP::host] ":" 1 ]/startPage
    }

    "/startpage" {
      # log 10.x.x.58 local0. "In startpage client ip is [IP::client_addr]"
      if { not [matchclass [IP::client_addr] equals All-Internal_dg] } {
        reject
      }
    }

    "/sap/admin" {
      # log 10..x.x.58 local0. "In sap admin client ip is [IP::client_addr]"
      if { not [matchclass [IP::client_addr] equals All-Internal_dg] } {
        reject
      }
      HTTP::redirect https://[getfield [HTTP::host] ":" 1 ]/sap/admin/public/default.html
    }

    "/sap/admin*" {
      # log 10..x.x.58 local0. "Deep in sap admin client ip is [IP::client_addr]"
      if { not [matchclass [IP::client_addr] equals All-Internal_dg] } {
        reject
      }
    }
    default {
      # log 10..x.x.58 local0. "Something hit the default switch client ip is [IP::client_addr]"
    }
  }
}