Removed the opensignserver url from the caller-allowable-codebase.
Added permission attribute to deployjava.js.