I know that this is an old question, but this has been something I've run into numerous times, so I figure that providing an answer may help others who have run into this.
In my experience, some versions of Snort have issues when switching from using HTTP options that reply on preprocessor parsing and then switching to not using them. Given the rule you provided, the first content string:
content:"Content-Type: text/html"; http_header;
Utilizes the http preprocessor and the Snort engine sort of gets into the mode of parsing parts of the request/response. Following up with the content string:
... without specifying where to find it, the Snort engine has difficulty finding it.
Of course, this is my "theory" formed upon experience and trial-and-error troubleshooting.
content:"Hello there"; before the other content (move to the left). If applicable, specify
content:"Hello there"; where it is, but try adding the
pkt_data; option prior to it. This would tell Snort to forget about parsing HTTP request/response elements and move the doe_ptr to the beginning of the HTTP request (i.e. the packet) and then search for the content. Or, if that content is expected in the file data of the response, use the
file_data; option instead. Again,
file_data; require you to put those options before the
content options that need to be affected.