Update readme to reflect requirements for callback url

If not specified user will see a "401 Unauthorized" error.
It's not immediately clear that Twitter requires this for
sign in and is not clear that any valid url can be used.

Possibly was the problem @wittawasw was having
in Issue #2.