allow request permissions later
fixes: $facebook.api shouldn't depends on login