Readme: Clarify authentication tokens, add stub section about app-only auth