tweaks on _validateWebAPIs (manifest as last parameter)