update README
note that both OAuth scopes are required