update readme

show env usage for api creds, fix links, move security tip