I suggest making the all_urls permission granted at runtime rather than required for installation, it's nice that it works on embedded videos now but for me 99% of the use case won't need that permission granted and I'm a little weary to grant it permanently.
