clarify exclusion in auth class