<!-- HTTP (cx.http/get/post/…) is core, so INTERNET is on by default. Every other
permission is opt-in: a built-in capability ships in the shell, but you add its
permission only when you use it, so an app never requests more than it needs. -->
<!-- Uncomment to enable the haptics capability (cx.haptic):
<uses-permission android:name="android.permission.VIBRATE" /> -->