readme: drive home the "service account" part.