updating readme to include credential instructions and TODO