Update README.md

Document auth:invalid event, note differences from the auth:validation-error event.