Updated manifest to give XSS permission for apaato.thebusby.com