Clarify defaults for credentials in README