Reduced the permissions required

Per comments here:
http://stackoverflow.com/questions/21767538/how-to-add-the-access-control-allow-origin-header-to-an-ajax-request/23036304#comment35195997_23036304

I've reduced permissions