Why "http://sample.com" ? I was thinking permissions are for device APIs, isn't it?