update README: change step order and add OAuth config step