Document access token configuration in the README

Since everyone needs to do this, I think it should be documented in the README.