Clarified CACHED_AUTH_PREPROCESSOR must return user

Updated README to indicate the CACHED_AUTH_PREPROCESSOR function has to return the user object.