The "right" way to limit a user to one EAP Type on FR2.1.7 addision question