update readme to make access token substitution more clear