use auth token and display headers.
remove note about lack of auth from README.