added manifest attributes for xhr permission