Try adding an ns_log statement to the end of security::locations

ns_log Notice "security::locations, locations: $locations"

Reload via APM and then try again.

Check your domain url against the values provided (and shown in the log), specifically the value closest to the one you are having problems with.

That should indicate where the offending data is (hopefully)!

cheers,

Torben