only "tabs" permissions are needed

This fixes a bug I was seeing in Chrome Canary where the extension was
getting hijacked and then disabled by Chrome.