Adjust README to reflect how auth actually works.