Update README.md
figuring out upstream merge
set password dev; token check needed