update README with auth instructions