add README; outsource passwords