Update README.md to clarify dev setup

Secret token needs to be set up before database migrations can be run