Add basic readme; make auth cookies non-session.