Change constant to variable

As it is let-bound in the authentication flow, it is not truly a
constant.  Add a warning to the documentation appropriately.
Remove unused permission

We are not using `private_info' yet, so there is no need to request this
permission.  It can, of course, be easily added later on if the
information is ever usable.