Update README.md

added clarification on the need to create a 2nd application to setup/configure the app for OAuth Authorization Code flow (enabling User Authentication/Delegation)