Clarify some OAuth details in the README.