update manifest, add permissions