readme: clarify that proxy-authorization is NEVER sent to the endpoint