updated readme for 'app only' authentication