Add note to UPGRADING

Author: johnnyshields

UPGRADING.md

@@ -77,6 +77,26 @@ settings.idp_slo_service_binding = :redirect
 
 For clarity, the default value of both parameters is `:redirect` if they are not set.
 
+### Addition of Settings sp_uuid_prefix and removal of Utils::UUID_PREFIX
+
+By default, the `uuid` (aliased to `request_id` / `response_id`) method in `RubySaml::Authrequest`,
+`RubySaml::Logoutrequest`, and `RubySaml::Logoutresponse` uses the `_` character as a default prefix,
+for example `_a1b3c5d7-9f1e-3d5c-7b1a-9f1e3d5c7b1a`. In RubySaml, versions prior to `2.0.0`, it was
+possible to change this default prefix by either calling `RubySaml::Utils.set_prefix` or by mutating
+the `RubySaml::Utils::UUID_PREFIX` constant (which was what `.set_prefix` did.) In RubySaml `2.0.0`,
+this prefix is now set using `settings.sp_uuid_prefix`:
+
+```ruby
+# Change the default prefix from `_` to `my_id_`
+settings.sp_uuid_prefix = 'my_id_'
+```
+
+A side-effect of this change is that the `uuid` (aliased to `request_id` / `response_id`) method in
+`RubySaml::Authrequest`, `RubySaml::Logoutrequest`, and `RubySaml::Logoutresponse` now is `nil` until
+the `#create` method is called. Previously, it was generated automatically during object instantiation.
+After calling `#create` for the first time the UUID will not change, even if a `Settings` object with
+a different `sp_uuid_prefix` is passed-in on subsequent calls.
+
 ### Deprecation of compression settings
 
 The `settings.compress_request` and `settings.compress_response` parameters have been deprecated
@@ -103,11 +123,10 @@ The following parameters in `RubySaml::Settings` are deprecated and will be remo
 
 ### Minor changes to Util#format_cert and #format_private_key
 
-
 Version `2.0.0` standardizes how RubySaml reads and formats certificate and private key
 PEM strings. In general, version `2.0.0` is more permissive than `1.x`, and the changes
 are not anticipated to affect most users. Please note the change affects parameters
-such `#idp_cert` and `#certificate`, as well as the `RubySaml::Util#format_cert`
+such `#idp_cert` and `#certificate`, as well as the `RubySaml::Utils#format_cert`
 and `#format_private_key` methods. Specifically: