Exclude the 'setup' directory.  It's not needed and would represent a security risk.
Updated the documentation.