more general pattern matching in manifest, refined login process, and added permissions note