Serialization of `javax.security.auth.AuthPermission` fails

[cowtowncoder]

with odd exception, stemming from inability to create accessor class.

It'd be nice to figure out specific rules instead of relying on naming. But data points we have for now are that:

• some javax.* packages work just fine; like javax.xml.datatype
• others -- ``javax.security.auth` not

So we can start with blacklisting (indicate ones with problems); if this doesn't cut it, generalize.