Update README.md

clarify server_token is the auth_token to use