added permissions for Cross-Origin XMLHttpRequests (in manifest.json)

No need for "--disable-web-security" anymore.

(see https://developer.chrome.com/extensions/xhr)