Require user-activation when requesting permissions

[pes10k]

Re w3c/sensors#397

Requesting a permission should require a user-activation, to prevent spamming users, make sure that there is some user consent even in situations if / when permissions are "inferred", etc.

E.g. good to ask permission when user clicks on "enable push notifications" or "enable access to sensors", etc, but not good to spam when the user is doing unrelated things (as many sites currently do)