add instruction re: app-specific passwords