permissions: <all_urls>