Clean up permissions

Should fix #813. I did not remove noembed because I couldn't find the CORS header with Inspector tools; can someone confirm? Also, if there are any other sites that have now since included a CORS header, please feel free to reply.