added Access-Control-Allow-Origin header in the mocked server
removed unnecessary permissions from manifest