Update README.md

Better instructions for people who just want to run it locally
Update package.json so `npm start` will work
Don't send username/password to reporting server on local scan. Close gh-24.

A more thorough technique would be to remove it on the server side; we can do
that later if needed.
Actually remove user/pass from the JSON data, not just the display.
Merge branch 'v4'
Timeout for the imagecompression test just in case it takes too long