cleanup: simplify popup.js, remove old gAPI permissions