exclude htpasswd