[exim] received_protocol help

I'm trying to stop any authenticated user's email from going through the
spam router. I've added the received_protocol != asmtp check to the
router like so:

   condition = \
     "${if and { {!def:h_X-Spam-Flag:} \
                 {!eq {$received_protocol}{spam-scanned}} \
                 {!eq {$received_protocol}{asmtp}} \
                 {!eq {$received_protocol}{local}} \

...yet the mail is still going through this router and being fed into
SpamAssassin. The email header itself does show it's authenticated:

   Received: from xxxxxxxxxxxx [xxxxxxx]
     by yak.fluid.com with esmtpsa (Exim 4.43 #1)
     for tengel@???

Is there something else that has to be done? From what I Google/read in
the docs, this should be doing the trick but it's not. Something obvious
I'm missing?

thx,
-te

--
Troy Engel | Systems Engineer
Fluid Inc. | http://www.fluid.com