readme: note xoauth* values must be base64-encoded