(Docs) Readme should mention current caveats with obtaining an access token

[benheymink]

Note

(This caught me out initially, so I think updating the docs would help others, too)

Currently, the sample app obtains an access token via HTTP request/s initiated from client-side code, meaning the integration secret is exposed. The official docs mention that "...This step uses your client secret, so it should be a server-side request rather than a client-side (browser-based) request" but I think the readme for this sample app should be updated to mention it too. (If you're happy to accept external PRs I'd be happy to contribute!).