added notes about auth to README