add note about permissions to README