README.md: document alternatives for oauth2 token more cleanly