Use exclude? method for authentication