Update README.md

Clarification on auth script which should NOT be in public directory.