update README to clarify what's going on with the "http" dependency