DB schema should be automatically upgraded when user tries to login.

If this is done, the user can browse an installation that has an old DB and wiki can therefore randomly fail or corrupt data.

The user should be presented with an option to NOT upgrade by not following the "upgrade" link. This way the user can choose to take backups before upgrading.

Done except for the "security hole" that lets users go directly to the /upgrade link without being asked for confirmation. There's probably some neat Eliom way of hiding the upgrade link unless it's being called from Session.with_user_login.

I'll leave upgrade link open. Assuming that the upgrade code is robust and that Nurpawiki is installed correctly, running upgrade should always be a NO-OP.