README.rst: remove :ref: usage

Author: Gallaecio

CHANGES.rst

@@ -6,7 +6,7 @@ Changes
 
 *   **Security bug fix:**
 
-    If you use ``HttpAuthMiddleware`` (i.e. the ``http_user`` and ``http_pass``
+    If you use HttpAuthMiddleware_ (i.e. the ``http_user`` and ``http_pass``
     spider attributes) for Splash authentication, any non-Splash request will
     expose your credentials to the request target. This includes ``robots.txt``
     requests sent by Scrapy when the ``ROBOTSTXT_OBEY`` setting is set to

README.rst

@@ -602,7 +602,7 @@ to ``splash_headers`` if you want to change credentials per-request::
             yield SplashRequest(url, self.parse,
                                 splash_headers={'Authorization': auth})
 
-**WARNING:** Don't use :ref:`HttpAuthMiddleware`
+**WARNING:** Don't use `HttpAuthMiddleware`_
 (i.e. ``http_user`` / ``http_pass`` spider attributes) for Splash
 authentication: if you occasionally send a non-Splash request from your spider,
 you may expose Splash credentials to a remote website, as HttpAuthMiddleware