Update README.md

added a couple of TODO items (kohana auth, one directory per user)