only use the site rule if there is no group rule

this way, if there is a specific access restriction on the item then it will override the site protection

src/authorizeRequest/authorizeRequest.js

@@ -36,7 +36,8 @@ async function authorizeRequest(userRequest, siteRule) {
   let isRootSite = indexOfRestricted ? indexOfRestricted < 5 : false;
 
   // If there is a whole-site protection rule, the group name will be the value of the rule.
-  if (siteRule) {
+  // Unless there is also a groupName from the file path, then groupName takes precedence.
+  if (siteRule && !groupName) {
     groupName = Object.values(siteRule)[0];
     // If there's nothing after the domain, then this is a root site.
     isRootSite = Object.keys(siteRule)[0] === domain;