Description of problem:
Upgrade Cluster from 4.0 to 4.1 fails with error updating field of template

Version-Release number of selected component (if applicable):
vdsm-4.19.2-1.gitd9c3ccb.el7.centos.x86_64
ovirt-engine-4.1.0.3-0.0.master.20170122091652.gitc6fc2c2.el7.centos.noarch

How reproducible:
All the time

Steps to Reproduce:
1. On DC with Compatibility Version 4.0 import a template
2. Create a VM from template, add disk, install OS, write data
3. Power VM off
4. Upgrade Cluster to 4.1 - fails with the following error:
Validation of action 'UpdateVmTemplate' failed for user admin@internal-auth
z. Reasons: VAR__ACTION__UPDATE,VAR__TYPE__VM_TEMPLATE,VMT_CANNOT_UPDATE_ILLEGAL_FIELD

Actual results:
Updata DC fails

Expected results:
DC should be successfully

Additional info:
From Engine.log
--------------------------------------------------
2017-01-24 14:05:59,469+02 INFO  [org.ovirt.engine.core.bll.UpdateClusterCommand] (default task-10) [5cd4526d] Lock freed to object 'EngineLock:{exclusiveLocks='[ecb07a15-ddcb-4360-8747-0a
f26c9e73d0=<TEMPLATE, ACTION_TYPE_FAILED_CLUSTER_IS_BEING_UPDATED$clusterName Cluster_upgrade>]', sharedLocks='[66bca1d9-b6e3-48a5-9a4e-ae8bb927e06c=<VM, ACTION_TYPE_FAILED_CLUSTER_IS_BEIN
G_UPDATED$clusterName Cluster_upgrade>]'}'
2017-01-24 14:07:17,850+02 INFO  [org.ovirt.engine.core.bll.UpdateClusterCommand] (default task-1) [d565600d-0980-4398-bf52-f6f910284af6] Lock Acquired to object 'EngineLock:{exclusiveLock
s='[ecb07a15-ddcb-4360-8747-0af26c9e73d0=<TEMPLATE, ACTION_TYPE_FAILED_CLUSTER_IS_BEING_UPDATED$clusterName Cluster_upgrade>]', sharedLocks='[66bca1d9-b6e3-48a5-9a4e-ae8bb927e06c=<VM, ACTI
ON_TYPE_FAILED_CLUSTER_IS_BEING_UPDATED$clusterName Cluster_upgrade>]'}'
2017-01-24 14:07:17,884+02 INFO  [org.ovirt.engine.core.bll.UpdateClusterCommand] (default task-1) [d565600d-0980-4398-bf52-f6f910284af6] Running command: UpdateClusterCommand internal: fa
lse. Entities affected :  ID: 9b797f15-388a-44d0-88ef-aa6bb4a71ec0 Type: ClusterAction group EDIT_CLUSTER_CONFIGURATION with role type ADMIN
2017-01-24 14:07:18,133+02 INFO  [org.ovirt.engine.core.bll.UpdateVmCommand] (default task-1) [52fca0b0] Running command: UpdateVmCommand internal: true. Entities affected :  ID: 66bca1d9-
b6e3-48a5-9a4e-ae8bb927e06c Type: VMAction group EDIT_VM_PROPERTIES with role type USER
2017-01-24 14:07:18,197+02 INFO  [org.ovirt.engine.core.bll.UpdateRngDeviceCommand] (default task-1) [487a3325] Running command: UpdateRngDeviceCommand internal: true. Entities affected : 
 ID: 66bca1d9-b6e3-48a5-9a4e-ae8bb927e06c Type: VMAction group EDIT_VM_PROPERTIES with role type USER
2017-01-24 14:07:18,224+02 INFO  [org.ovirt.engine.core.dal.dbbroker.auditloghandling.AuditLogDirector] (default task-1) [487a3325] EVENT_ID: SYSTEM_UPDATE_VM(253), Correlation ID: 52fca0b
0, Call Stack: null, Custom Event ID: -1, Message: VM vm configuration was updated by system.
2017-01-24 14:07:18,333+02 WARN  [org.ovirt.engine.core.bll.UpdateVmTemplateCommand] (default task-1) [4f8c2f29] Validation of action 'UpdateVmTemplate' failed for user admin@internal-auth
z. Reasons: VAR__ACTION__UPDATE,VAR__TYPE__VM_TEMPLATE,VMT_CANNOT_UPDATE_ILLEGAL_FIELD
2017-01-24 14:07:18,375+02 ERROR [org.ovirt.engine.core.bll.UpdateRngDeviceCommand] (default task-1) [4f8c2f29] Transaction rolled-back for command 'org.ovirt.engine.core.bll.UpdateRngDevi
ceCommand'.
2017-01-24 14:07:18,375+02 ERROR [org.ovirt.engine.core.bll.UpdateVmCommand] (default task-1) [4f8c2f29] Transaction rolled-back for command 'org.ovirt.engine.core.bll.UpdateVmCommand'.
2017-01-24 14:07:18,375+02 ERROR [org.ovirt.engine.core.bll.UpdateClusterCommand] (default task-1) [4f8c2f29] Transaction rolled-back for command 'org.ovirt.engine.core.bll.UpdateClusterCo
mmand'.
2017-01-24 14:07:18,399+02 ERROR [org.ovirt.engine.core.dal.dbbroker.auditloghandling.AuditLogDirector] (default task-1) [4f8c2f29] EVENT_ID: USER_UPDATE_CLUSTER_FAILED(812), Correlation ID: d565600d-0980-4398-bf52-f6f910284af6, Call Stack: null, Custom Event ID: -1, Message: Failed to update Host cluster (User: admin@internal-authz)