Lock down permissions on Chrome manifest