Help with priority & middleware in IngressRoute

Traefik Traefik v2 (latest)
1

Hoping someone can help me here, I have the following IngressRoute.
I am using a basic auth middleware (ingress-auth-blah). It works fine on the 3rd rule PathPrefix(/) login displayed as expected. I can add or remove the same middleware to 2nd rule and will work as expected.

However im having issues with the 1st rule PathPrefix(/scan). No matter what I set the priority to any request to blah.blah.com/scan will get picked up by the 3rd rule and request auth.

Am I missing something here? is it because rule 1 & 3 use the same service?

Any help would be greatly appreciated

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  labels:
    app.kubernetes.io/instance: blah
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: blah-blah
    app.kubernetes.io/version: 1.16.0
    helm.sh/chart: blah-blah-0.1.0
  name: blah-blah-blah-blah
  namespace: default
spec:
  entryPoints:
    - websecure
  routes:
    - kind: Rule
      match: Host(`blah.blah.com`) && PathPrefix(`/scan`)
      priority: 100
      services:
        - name: blah-service1
          port: 80
    - kind: Rule
      match: Host(`blah.blah.com`) && PathPrefix(`/service2`)
      priority: 10
      # middlewares:
      #   - name: ingress-auth-blah
      services:
        - name: blah-service2
          port: 3000
    - kind: Rule
      match: Host(`blah.blah.com`) && PathPrefix(`/`)
      middlewares:
        - name: ingress-auth-blah
      priority: 1
      services:
        - name: blah-service1
          port: 80
  tls:
    certResolver: lestage