update readme
/login, /logout : only redirect to local URLs