Add notes to clarify use of OAuth access tokens