updated readme to explain how authentication works