update license excludes for new location of customized csrfguard bits