permissions in requestPermissions are now optional (defaults to same as login)