Update README to clarify how credentials are loaded