Update README.md

Better instructions for people who just want to run it locally
Update package.json so `npm start` will work
Don't send username/password to reporting server on local scan. Close gh-24.

A more thorough technique would be to remove it on the server side; we can do
that later if needed.