Update manifest.webapp

add XHR permission