README: document that hosted version only works for non-SSL traffic