added permissions for Cross-Origin XMLHttpRequests (fixed tabs)