added another paragraph in upgrade.md for permissions