Remove <all_urls> permission

For better security and just to soothe the privacy concerns of some users, we've made our permissions stricter.