Keep CLI credentials and requests bound to their initiating session

.github/workflows/ci.yml

@@ -169,7 +169,7 @@ jobs:
 
   macos-pkg-smoke:
     name: macOS existing PKG smoke
-    runs-on: macos-14
+    runs-on: macos-15-intel
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5

.github/workflows/release.yml

@@ -26,7 +26,7 @@ jobs:
       matrix:
         include:
           - name: macos-universal2
-            os: macos-14
+            os: macos-15-intel
             macos_arch: universal2
           - name: windows-x64
             os: windows-latest

README.md

@@ -97,6 +97,18 @@ Set the API base URL if you are not using the default:
 dataplicity config set --base-url https://gateway.dataplicity.com
 ```
 
+Use HTTPS for remote API servers; HTTP is supported for loopback development.
+Changing the saved server clears its previous authentication. A one-command
+`--base-url` override uses no credentials saved for a different server; sign in
+to the selected server before using protected commands. An override alone does
+not overwrite the original configuration file.
+
+Commands retain the sign-in they started with. If another process signs in or
+out while a command is waiting, the older command stops using that session and
+asks you to start again. Configuration updates use a private atomic file and a
+short process lock; a delayed renewal cannot overwrite a newer sign-in. A lost
+renewal response can be retried with the saved recovery identifier.
+
 Login with email/password:
 
 ```