Updated manifest.json with xhr permissions