Documenting permissions for OAuth tutorial

chrome/common/extensions/docs/static/tut_oauth.html

 <div id="pageData-name" class="pageData">Tutorial: OAuth</div>
 <div id="pageData-showTOC" class="pageData">true</div>
 
 <p>
 <a href="http://oauth.net/">OAuth</a> is an open protocol that aims to standardize the way desktop and web applications access a user's private data. OAuth provides a mechanism for users to grant access to private data without sharing their private credentials (username/password). Many sites have started enabling APIs to use OAuth because of its security and standard set of libraries.
 </p>
 <p>
 This tutorial will walk you through the necessary steps for creating a Google Chrome Extension that uses OAuth to access an API. It leverages a library that you can reuse in your extensions.
 </p>
 <p>
@@ skipping 68 matching lines @@
   'request_url': 'https://www.google.com/accounts/OAuthGetRequestToken',
   'authorize_url': 'https://www.google.com/accounts/OAuthAuthorizeToken',
   'access_url': 'https://www.google.com/accounts/OAuthGetAccessToken',
   'consumer_key': 'anonymous',
   'consumer_secret': 'anonymous',
   'scope': 'https://docs.google.com/feeds/',
   'app_name': 'My Google Docs Extension'
 });
 </pre>
 
+<p>
+To use the OAuth library,
+you must declare the "tabs" permision in the
+<a href="http://code.google.com/chrome/extensions/manifest.html">extension manifest</a>.
+You must also declare the sites you are using
+including the request URL, the authorize URL, access URL,
+and, if necessary, the scope URL.
+For example:
+</p>
+
+<pre>
+"permissions": [ "tabs", "https://docs.google.com/feeds/*",
+  "https://www.google.com/accounts/OAuthGetRequestToken",
+  "https://www.google.com/accounts/OAuthAuthorizeToken",
+  "https://www.google.com/accounts/OAuthGetAccessToken" 
+]
+</pre>
+
 <h3 id="request-token">Fetching and authorizing a request token</h3>
 
 <p>
 Once you have your background page set up, call the <code>authorize()</code> function to begin the OAuth dance and redirect the user to the OAuth provider. The client library abstracts most of this process, so all you need to do is pass a callback to the <code>authorize()</code> function, and a new tab will open and redirect the user.
 </p>
 
 <pre>
 oauth.authorize(function() {
   // ... Ready to fetch private data ...
 });
@@ skipping 90 matching lines @@
 
 <p>
 Sample extensions that use these techniques are available in the Chromium source tree:
 </p>
 
 <ul>
 <li><a href="http://src.chromium.org/viewvc/chrome/trunk/src/chrome/common/extensions/docs/examples/extensions/gdocs/">.../examples/extensions/gdocs/</a></li>
 <li><a href="http://src.chromium.org/viewvc/chrome/trunk/src/chrome/common/extensions/docs/examples/extensions/oauth_contacts/">.../examples/extensions/oauth_contacts/</a></li>
 </ul>