Update README.md

Add explanation for Client Password mechanism