I haven't checked, but does gfycat.com not support CORS?

if it does, I would strongly prefer that permissions not be added here because with CORS, permissions aren't necessary.

if it does not, I would prefer that optional permissions be used - as we've had lots of problems with users who do not understand the permissions dialog freaking out, accusing us of "selling marketing data" etc because the Chrome dialog is rather intimidating and unclear.