Add googleapis.com to permissions in manifest.json to allow CORS request