Update README.md

missed two references to REST API, changed to Auth API