Why exclude unset auid in STIG rules