diff --git a/cmd/proxy/actions/app.go b/cmd/proxy/actions/app.go
index 295e055a..8ebf7bd7 100644
--- a/cmd/proxy/actions/app.go
+++ b/cmd/proxy/actions/app.go
@@ -119,6 +119,11 @@ func App(conf *config.Config) (*buffalo.App, error) {
 
 	initializeAuth(app)
 
+	user, pass, ok := conf.BasicAuth()
+	if ok {
+		app.Use(basicAuth(user, pass))
+	}
+
 	if !conf.FilterOff() {
 		mf, err := module.NewFilter(conf.FilterFile)
 		if err != nil {
@@ -132,11 +137,6 @@ func App(conf *config.Config) (*buffalo.App, error) {
 		app.Use(mw.LogEntryMiddleware(mw.NewValidationMiddleware, lggr, vHook))
 	}
 
-	user, pass, ok := conf.BasicAuth()
-	if ok {
-		app.Use(basicAuth(user, pass))
-	}
-
 	if err := addProxyRoutes(app, store, lggr, conf.GoBinary, conf.GoGetWorkers, conf.ProtocolWorkers); err != nil {
 		err = fmt.Errorf("error adding proxy routes (%s)", err)
 		return nil, err
diff --git a/pkg/middleware/filter.go b/pkg/middleware/filter.go
index ccfe3969..419129b1 100644
--- a/pkg/middleware/filter.go
+++ b/pkg/middleware/filter.go
@@ -13,7 +13,7 @@ import (
 
 // NewFilterMiddleware builds a middleware function that implements the
 // filters configured in the filter file.
-func NewFilterMiddleware(mf *module.Filter, registryEndpoint string) buffalo.MiddlewareFunc {
+func NewFilterMiddleware(mf *module.Filter, upstreamEndpoint string) buffalo.MiddlewareFunc {
 	const op errors.Op = "actions.NewFilterMiddleware"
 
 	return func(next buffalo.Handler) buffalo.Handler {
@@ -25,23 +25,17 @@ func NewFilterMiddleware(mf *module.Filter, registryEndpoint string) buffalo.Mid
 				return next(c)
 			}
 
-			// not checking the error. Not all requests include a version
-			// i.e. list requests path is like /{module:.+}/@v/list with no version parameter
-			version, _ := paths.GetVersion(c)
-
-			if isPseudoVersion(version) {
-				return next(c)
-			}
-
 			rule := mf.Rule(mod)
 			switch rule {
 			case module.Exclude:
+				// Exclude: ignore request for this module
 				return c.Render(http.StatusForbidden, nil)
-			case module.Direct:
-				return next(c)
 			case module.Include:
-				// TODO : spin up cache filling worker and serve the request using the cache
-				newURL := redirectToRegistryURL(registryEndpoint, c.Request().URL)
+				// Include: please handle this module in a usual way
+				return next(c)
+			case module.Direct:
+				// Direct: do not store modules locally, use upstream proxy
+				newURL := redirectToUpstreamURL(upstreamEndpoint, c.Request().URL)
 				return c.Redirect(http.StatusSeeOther, newURL)
 			}
 
@@ -50,10 +44,6 @@ func NewFilterMiddleware(mf *module.Filter, registryEndpoint string) buffalo.Mid
 	}
 }
 
-func isPseudoVersion(version string) bool {
-	return strings.HasPrefix(version, "v0.0.0-")
-}
-
-func redirectToRegistryURL(registryEndpoint string, u *url.URL) string {
-	return strings.TrimSuffix(registryEndpoint, "/") + u.Path
+func redirectToUpstreamURL(upstreamEndpoint string, u *url.URL) string {
+	return strings.TrimSuffix(upstreamEndpoint, "/") + u.Path
 }
diff --git a/pkg/middleware/middleware_test.go b/pkg/middleware/middleware_test.go
index 78c6343c..696b02e4 100644
--- a/pkg/middleware/middleware_test.go
+++ b/pkg/middleware/middleware_test.go
@@ -51,9 +51,9 @@ func newTestFilter(filterFile string) (*module.Filter, error) {
 	if err != nil {
 		return nil, err
 	}
-	f.AddRule("github.com/gomods/athens/", module.Include)
+	f.AddRule("github.com/gomods/athens/", module.Direct)
 	f.AddRule("github.com/athens-artifacts/no-tags", module.Exclude)
-	f.AddRule("github.com/athens-artifacts", module.Direct)
+	f.AddRule("github.com/athens-artifacts", module.Include)
 	return f, nil
 }
 
diff --git a/pkg/module/filterRule.go b/pkg/module/filterRule.go
index 52a3c00c..3a8b88f2 100644
--- a/pkg/module/filterRule.go
+++ b/pkg/module/filterRule.go
@@ -4,12 +4,13 @@ package module
 type FilterRule int
 
 const (
-	// Default filter rule does not alter default behavior
+	// Default filter rule does not alter default/parent behavior
 	Default FilterRule = iota
-	// Include filter rule includes package and its children from communication
+	// Include treats modules the usual way
+	// Used for reverting Exclude of parent path
 	Include
 	// Exclude filter rule excludes package and its children from communication
 	Exclude
-	// Direct filter rule forces the package to be fetched directly from the vcs
+	// Direct filter rule forces the package to be fetched directly from upstream proxy
 	Direct
 )