readme: describe .auth.json file