Remove all permission requests from the Chrome manifest.

dev/webpack.config.js

@@ -197,6 +197,7 @@ function transformManifest( content, target ) {
 		}
 
 		if ( target === 'chrome' ) {
+			delete content.permissions;
 			delete content.browser_specific_settings;
 		} else {
 			// Firefox doesn't have support for the CodeEditor for now.

src/app/modules/util.js

@@ -159,16 +159,20 @@ export function injectFunctionExecution( fn ) {
 export function openXmlHttpRequest( url, method = 'POST' ) {
 	const location = window.__getLocation();
 
+	const isLocal = url.startsWith( '/' );
+
 	// Firefox needs the whole url, so we fix it here, if necessary.
-	if ( url.startsWith( '/' ) ) {
+	if ( isLocal ) {
 		url = `${ location.protocol }//${ location.host }${ url }`;
 	}
 
 	const xhr = new XMLHttpRequest();
 	xhr.open( method, url, true );
 
-	// Some of the requests don't work without this one.
-	xhr.setRequestHeader( 'X-Requested-With', 'XMLHttpRequest' );
+	if ( isLocal ) {
+		// GitHub requires this on some of the local XHR requests.
+		xhr.setRequestHeader( 'X-Requested-With', 'XMLHttpRequest' );
+	}
 
 	return xhr;
 }

src/extension/manifest.json

@@ -9,6 +9,7 @@
   "permissions": [
 	// Amazon S3 is used by GitHub to upload files. We need to have permissions on it,
 	// so we avoid cross-origin issues when mimicking the upload within the GitHubUploadAdapter class.
+	// Firefox only.
 	"https://*.s3.amazonaws.com/"
   ],
   "content_scripts": [