Update step2.md

Make it clear that "gcm" is added to permissions, and does not replace it completely.