Describe bogus auth header in readme

Closes #25