Yeah, it's correct, we're not supporting upgrades from HEAD to HEAD, and we haven't tackled upgrade from 4.6.3 yet (but we will, starting Monday 29th).
auth_authorities gets populated, first in packages/acs-kernel/sql/postgresql/acs-create.sql, then in the after-install callback on acs-authentication, when the necessary service contracts have been created and implementations registered.
Hope this helps.
/Lars
