How can I chain CanActivate in Angular 2

Question

I have the following route definition...

const COMMON_ROUTES = [
    {
        path: "login",
        component: LoginComponent,
        pathMatch: "prefix",
        canActivate: [ CanActivateIfAnonymous ],
        children: [
            {
                path: "",
                component: PasswordLoginComponent,
                canActivate: [CanActivateIfPassword],
            },
            {
                path: "pki",
                component: PkiLoginComponent,
                canActivate: [CanActivateIfPki],
            },
        ],
    },
];

Then I have my CanActivates...

export class CanActivateIfPassword implements CanActivate {
    constructor(private loginSettingsService: LoginSettingService,
                private router: Router) { }
    canActivate(
        route: ActivatedRouteSnapshot,
        state: RouterStateSnapshot,
    ) {
        console.log("Password Check");
        return this.loginSettingsService.loginSettings.map(settings =>{
            console.log("Password Check Finished");
            return true;
        });
    }
}
export class CanActivateIfPki implements CanActivate {
    constructor(private loginSettingsService: LoginSettingService) { }
    canActivate(
        route: ActivatedRouteSnapshot,
        state: RouterStateSnapshot,
    ) {
        console.log("PKI Check");
        return this.loginSettingsService.loginSettings.map((settings) => {
            console.log("PKI Check Finished");
            return settings["pki"];
        });
    }
}

But when I run this I would expect...

Password Check
Password Check Finished
PKI Check
PKI Check Finished

But instead I get...

Password Check
PKI Check
PKI Check Finished

I do notice that loginSettings is a value and not an observable so the other observable comes first. I will try to post a plunker soon.

Plunker

This one prints out like...

Password Check
PKI Check
PKI Check Finished
Password Check Finished

Which is also not what I want. So I will check on the missing statement but my question still applies. But it actually makes sense because in my code PKI is redirecting.