"emigration from artifactory to access" fails

Upgraded artifactory deb version from 5.5.2 to 5.6.0

artifactory log shows:

2017-11-17 11:27:38,614 [art-init] [INFO ] (o.a.s.a.e.AccessSecurityEmigratorImpl:42) - Starting emigration from artifactory to access
2017-11-17 11:27:39,485 [art-init] [ERROR] (o.a.c.ConvertersManagerImpl:216) - Conversion failed. You should analyze the error and retry launching Artifactory. Error is: HTTP response

status 403:{
  "errors" : [ {
    "code" : "FORBIDDEN",
    "message" : "Logged in 'jfac@01btna61r80s0n0y2ydfda1tyy/users/admin' is not an admin."
  } ]
}

2017-11-17 11:27:39,491 [art-init] [ERROR] (o.a.w.s.ArtifactoryContextConfigListener:99) - Application could not be initialized: HTTP response status 403:{
"errors" : [

Unknown macro: { "code" }

]
}
java.lang.reflect.InvocationTargetException: null
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[na:1.8.0_151]
at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) ~[na:1.8.0_151]
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[na:1.8.0_151]
at java.lang.reflect.Constructor.newInstance(Constructor.java:423) ~[na:1.8.0_151]
at org.artifactory.webapp.servlet.ArtifactoryContextConfigListener.configure(ArtifactoryContextConfigListener.java:224) ~[artifactory-web-application-5.6.0.jar:na]
at org.artifactory.webapp.servlet.ArtifactoryContextConfigListener.access$2(ArtifactoryContextConfigListener.java:186) ~[artifactory-web-application-5.6.0.jar:na]
at org.artifactory.webapp.servlet.ArtifactoryContextConfigListener$1.run(ArtifactoryContextConfigListener.java:95) ~[artifactory-web-application-5.6.0.jar:na]
Caused by: java.lang.RuntimeException: HTTP response status 403:{
"errors" : [

Unknown macro: { "code" }

]
}
at org.artifactory.converter.ConvertersManagerImpl.handleException(ConvertersManagerImpl.java:223) ~[artifactory-common-5.6.0.jar:na]
at org.artifactory.converter.ConvertersManagerImpl.serviceConvert(ConvertersManagerImpl.java:171) ~[artifactory-common-5.6.0.jar:na]
at org.artifactory.spring.ArtifactoryApplicationContext.refresh(ArtifactoryApplicationContext.java:232) ~[artifactory-core-5.6.0.jar:na]
at org.artifactory.spring.ArtifactoryApplicationContext.<init>(ArtifactoryApplicationContext.java:120) ~[artifactory-core-5.6.0.jar:na]
... 7 common frames omitted
Caused by: org.jfrog.access.client.AccessClientHttpException: HTTP response status 403:{
"errors" : [

Unknown macro: { "code" }

]
}
at org.jfrog.access.client.http.AccessHttpClient.createRestResponse(AccessHttpClient.java:133) ~[access-client-core-3.0.0.jar:na]
at org.jfrog.access.client.http.AccessHttpClient.restCall(AccessHttpClient.java:108) ~[access-client-core-3.0.0.jar:na]
at org.jfrog.access.client.imports.ImportClientImpl.importSecurityEntities(ImportClientImpl.java:38) ~[access-client-core-3.0.0.jar:na]
at org.artifactory.security.access.AccessServiceImpl.importSecurityEntities(AccessServiceImpl.java:952) ~[artifactory-core-5.6.0.jar:na]
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.8.0_151]
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:1.8.0_151]
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0_151]
at java.lang.reflect.Method.invoke(Method.java:498) ~[na:1.8.0_151]
at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:317) ~[spring-aop-4.1.5.RELEASE.jar:4.1.5.RELEASE]
at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:201) ~[spring-aop-4.1.5.RELEASE.jar:4.1.5.RELEASE]
at com.sun.proxy.$Proxy94.importSecurityEntities(Unknown Source) ~[na:na]
at org.artifactory.security.SecurityServiceImpl.importSecurityData(SecurityServiceImpl.java:2461) ~[artifactory-core-5.6.0.jar:na]
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.8.0_151]
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:1.8.0_151]
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0_151]
at java.lang.reflect.Method.invoke(Method.java:498) ~[na:1.8.0_151]
at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:317) ~[spring-aop-4.1.5.RELEASE.jar:4.1.5.RELEASE]
at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:190) ~[spring-aop-4.1.5.RELEASE.jar:4.1.5.RELEASE]
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157) ~[spring-aop-4.1.5.RELEASE.jar:4.1.5.RELEASE]
at org.springframework.transaction.interceptor.TransactionInterceptor$1.proceedWithInvocation(TransactionInterceptor.java:99) ~[spring-tx-4.1.5.RELEASE.jar:4.1.5.RELEASE]
at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:281) ~[spring-tx-4.1.5.RELEASE.jar:4.1.5.RELEASE]
at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:96) ~[spring-tx-4.1.5.RELEASE.jar:4.1.5.RELEASE]
at org.artifactory.storage.fs.lock.aop.LockingAdvice.invoke(LockingAdvice.java:76) ~[artifactory-storage-common-5.6.0.jar:na]
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) ~[spring-aop-4.1.5.RELEASE.jar:4.1.5.RELEASE]
at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:207) ~[spring-aop-4.1.5.RELEASE.jar:4.1.5.RELEASE]
at com.sun.proxy.$Proxy93.importSecurityData(Unknown Source) ~[na:na]
at org.artifactory.security.access.emigrate.AccessSecurityEmigratorImpl.emigrate(AccessSecurityEmigratorImpl.java:47) ~[artifactory-core-5.6.0.jar:na]
at org.artifactory.security.SecurityServiceImpl.convert(SecurityServiceImpl.java:315) ~[artifactory-core-5.6.0.jar:na]
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.8.0_151]
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:1.8.0_151]
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0_151]
at java.lang.reflect.Method.invoke(Method.java:498) ~[na:1.8.0_151]
at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:317) ~[spring-aop-4.1.5.RELEASE.jar:4.1.5.RELEASE]
at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:201) ~[spring-aop-4.1.5.RELEASE.jar:4.1.5.RELEASE]
at com.sun.proxy.$Proxy93.convert(Unknown Source) ~[na:na]
at org.artifactory.converter.ConvertersManagerImpl.serviceConvert(ConvertersManagerImpl.java:167) ~[artifactory-common-5.6.0.jar:na]
... 9 common frames omitted
2017-11-17 11:27:43,176 [http-nio-8081-exec-8] [ERROR] (o.a.w.s.ArtifactoryFilter:199) - Artifactory failed to initialize: Context is null

after restart, artifactory starts up, but all user permissions seem to have been reset or lost or something.

although users can still login on the web interfaces, they cannot download any artifacts from the private repos or deploy artifacts.
most notably, no user seems to have admin access anymore.

probably due to this entry in the log (during restart after initial conversion exception above).

2017-11-17 11:30:10,987 [art-init] [INFO ] (o.a.s.SecurityServiceImpl:2355) - Creating the default super user 'admin', since no admin user exists!
2017-11-17 11:30:11,186 [art-init] [ERROR] (o.a.s.SecurityServiceImpl:2365) - No admin user where found, but the default user named 'admin' exists and is not admin!
Updating the super user 'admin' with default state and password!
2017-11-17 11:30:11,557 [art-init] [INFO ] (o.a.s.SecurityServiceImpl:2385) - Creating the default anonymous user, since it does not exist!

how do we restore the user permissions / access rights?

or how do we downgrade to the previous version?