updated readme to mention required permissions