title: Chrome extension Cross Domain Request
body: <p>I know that this has been talked about many times here, and I have read most of these threads but I can't seem to get my script working.</p>
  
  <p>Problem is that I am trying to use bitly api to shorten urls in google chrome extension. I am saving users login and apiKey in localstorage and before I do so I validate them. </p>
  
  <p>The code to do so is: </p>
  
  <pre><code>$.ajax({
          url:"http://api.bit.ly/v3/validate",
          dataType:'jsonp',
          data:{
              login: login,
              apiKey: apiKey,
              x_login :"test",
              x_apiKey :"test"
          },
          success:function (jo, textStatus, jqXHR) {
              if (jo.status_code == 200) {
                  setItem('dg_BitlyApiKey', apiKey);
                  setItem('dg_BitlyLogin', login);
                  alert('Saved');
              } else {
                  alert('Incorrect login and/or apiKey!')
              }
          }
      });
  </code></pre>
  
  <p>I do have my permissions set to <code>"permissions": ["tabs", "notifications", "http://*/*", "https://*/*"]</code> but I still keep getting:</p>
  
  <pre><code>Refused to load script from 'http://api.bit.ly/v3/validate?callback=jQuery17204477599645033479_1334062200771&amp;login=&amp;apiKey=&amp;x_login=test&amp;x_apiKey=test&amp;_=1334062201506' because of Content-Security-Policy.
  </code></pre>
  
  <p>The script itself works outside the extension so I assume the problem isn't within the script but with the permissions.</p>
  
  <p>What am I doing wrong here?</p>