Updates README with some user permission details

I ran into some gotcha's when implementing this myself. Updated the README doc to help out