add mention of secret_token in README