I have proxy authentication enabled for access, but users are getting
through and not being prompted to authenticate.

I created a rule using an IP address as a source and I get prompted by
proxy for authentication so I know authentication is working. I am using
SurfControl and if I try to access a restricted site i.e
"playboy.com", I get prompted for authentication and then the expected
403 forbidden error.

Anybody have any ideas?