updated documentation for sources, making clearer how to obtain passwords and API keys