--- a/doc/upgrading.txt	Mon Jan 11 17:43:37 2016 +0300
+++ b/doc/upgrading.txt	Mon Jan 11 19:04:12 2016 +0300
@@ -23,6 +23,9 @@
 Migrating from 1.5.0 to 1.5.1
 =============================
 
+User data visibility
+--------------------
+
 For security reasons you should change the permissions on the user
 class. We previously shipped a configuration that allowed users to see
 too many of other users details, including hashed passwords under
@@ -40,6 +43,10 @@
 Note that this removes visibility of user emails, if you want emails to
 be visible you can add 'address' and 'alternate_addresses' to the list
 above.
+
+XSS protection for custom actions
+---------------------------------
+
 If you have defined your own cgi actions in your tracker instance
 (e.g. in a custom ``extensions/spambayes.py`` file) you need to modify
 all cases where client.error_message or client.ok_message are modified