clarifying readme for token based authentication