typo in README
move unlocking to auth, leave env to session