readme: how to auth w/ a token