Update README

Apply a custom policy to the Video user instead of giving them full
access to S3, ElasticTranscoder and SNS. Having experimented with the
S3 permissions required we now know that the Video user only needs the
`GetObject` and `PutObject` permissions for this app to work correctly.

The ElasticTranscoder and SNS permissions in this policy can probably
be reduced but we'll leave that for another time.

Fixes #18.