Fixed comments & README

It's NOT using application-only authentication (that would require
HTTPS)