Add more explicit comment about app credentials.