Offlioad is in the wrong section.

Offload is between content/pcre and Bluedot.  This leads to unexpected results. 

For example,  offload is call when the basics of the signature are called (content/pcre),  handed to Offload() and _then_ Bluedot/GeoIP is evaluated.   This is incorrect.   Offiload() should be call _after_ GeoIP and Bluedot.
