Added note about keeping your token out of config