Add support for GCP_OAUTH2_REFRESH_TOKEN env variable.

This addresses #8.

Also:
* Be more robust about detecting GCE service account scopes. (#5)
* Clarify different auth methods in README.md
just in case: i'm fine with recommending env-file as long as we say about regular 'ps' instead of 'docker ps'