Make note about the password variable

Missing piece from #1 was an update to the README to include the password specification.