Clarify personal access tokens:

- Clarify that personal access tokens are required when using two-factor auth
- Add a personal access token example
- Discourage persisting passwords