Allow a user to access blocked websites

I have a URL filter profile that blocks URLs that I don't want our users to access. This policy works and applies to all users. There are a couple of users who need to access the blocked URLs, so I created the following steps:

1. Create custom url category.

2. Create custom url filter profile.

3. Configure a new security rule. Add the username under the Source tab. Action tab is set to Allow. Add user filter profile. And move this security rule to the top.

It still doesn't work as the user still can't get to the blocked URL. Any suggestions? Thanks.