satisfy problem

[lhmwzy]

in 0.9.7
 use:

        location ^~ /ks/admin
        {
                satisfy any;
                allow 10.68.136.241/32;
                allow 10.66.23.80/32;
                deny all;
                auth_basic "passwd";
                auth_basic_user_file ksadminpasswd;
       }

when IP is not 10.68.136.241 or 10.66.23.80, people can still visit
/ks/admin,not prompt for user and passwd.

Is this a bug?