update readme and spec for current release

SPEC.md

@@ -53,15 +53,21 @@ For a given timestamp `t` (seconds), an actor is visible if any of their
 
 ## API
 
+All read endpoints below require an authenticated Jellyfin user token (passed as
+`X-Emby-Token` or `Authorization: MediaBrowser Token="..."`); the admin endpoints
+additionally require the **Administrator** role. Only `GET /Plugins/JRay/ClientScript`
+is anonymous.
+
 ### `GET /Plugins/JRay/Items/{itemId}/Timeline`
 
 Returns the full truth file (schema above) for an item, or `404` if no truth
-data exists (neither a managed upload nor a sidecar file).
+data exists (neither a managed upload nor a sidecar file). Requires an
+authenticated user token.
 
 ### `GET /Plugins/JRay/Items/{itemId}/jray?t={seconds}`
 
 Returns an extensible "context at time t" envelope, or `404` if no truth
-data exists for the item:
+data exists for the item. Requires an authenticated user token:
 
 ```json
 {