Update README.

Fix example URLs now that vhost configuration is required and document
that secure_rewrites may be necessary.