add credential handling to README