Update the readme to clarify the OAuth2 login process