clearer readme for url auth