Restrict root access

upgrade-nonroot maybe a somewhat confusing name nowadays that at time of writing isn’t functional in user session but instead requires sysmaint session.