Set a few TODOs. Switch from ANONYMOUS to EXTERNAL auth. mechanism. Update README.