Surfing Quota Exceeded But Not Enforcing

I'm having an issue with enforcing surfing quotas.  I've been playing with this for a while.

I'm testing with a user account that I applied the out of the box 1 hour surfing quota policy to.

I see in several different places that the surfing quota was exceed.  In the XG web gui, in the client authentication agent, on an iPad.

But I can still surf the internet through a browser.

What can I be missing?

I'm trying to limit kids surfing but it never gets stopped.

Any help is appreciated.

Thanks in advance.

Some updates:

I noticed from my Mac, that when the quota is exceeded, the client authentication agent sends a popup that the quota was exceeded and goes off line.  So all traffic after that is not associated with the user.  In that state, all rules are processed just by IP address and not user.  No user name shows up in the logs for any log entry.

I was hoping for the web page to come up stating that surfing quota was exceeded.  I though this used to work in the past but that may have been back when I was using UTM9.