updated README to show token-based credentials