add additional information to README regarding auth