updated README to explain local setup and turn auth off