Update README.md

Made a change to clarify that cookies should NOT be used as an authentication mechanism as this could lead to phishing attacks.