Update auth setup documentation

[colbylwilliams]

Related to issue #331 and #332 we need to update the auth setup docs.

Microsoft now looks to require verified domains/subdomains for service principal ids that start with http. See #331 for an example of the error (thanks @luxu-ms).

Docs should be updated to assume api://

We're also currently making some assumptions about http in the code, and should make sure we're not.