README: Clarify handling of passwords/credentials

Fixes #51.