update README with SECRET_TOKEN instructions